A R IGOROUS E VALUATION OF R EAL -W ORLD D ISTRIBUTION S HIFTS
Anonymous authors
Paper under double-blind review
A BSTRACT
We introduce three new robustness benchmarks consisting of naturally occurring distribution changes in image style, geographic location, camera operation, and more.
Using our benchmarks, we take stock of previously proposed hypotheses for out-of-distribution robustness and put them to the test.
We ﬁnd that using larger models and synthetic data augmentation can improve robustness on real-world distribution shifts, contrary to claims in prior work.
Motivated by this, we introduce a new data augmentation method which advances the state-of-the-art and outperforms models pretrained with 1000 × more labeled data.
We ﬁnd that some methods consistently help with distribution shifts in texture and local image statistics, but these methods do not help with some other distribution shifts like geographic changes.
Hence no evaluated method consistently improves robustness.
We conclude that future research must study multiple distribution shifts simultaneously.
I NTRODUCTION
While the research community must create robust models that generalize to new scenarios, the robustness literature (Dodge and Karam, 2017; Geirhos et al., 2020) lacks consensus on evaluation benchmarks and contains many dissonant hypotheses.
Hendrycks et al.
(2020a)
ﬁnd that many recent language models are already robust to many forms of distribution shift, while Yin et al.
and
Geirhos et al.
ﬁnd that vision models are largely fragile and argue that data augmentation offers one solution.
In contrast, Taori et al.
(2020) provide results suggesting that using pretraining and improving in-distribution test set accuracy improve natural robustness, whereas other methods do not.
In this paper we articulate and systematically study seven robustness hypotheses.
The ﬁrst four hypotheses concern methods for improving robustness, while the last three hypotheses concern abstract properties about robustness.
These hypotheses are as follows.
• Larger Models : increasing model size improves robustness (Hendrycks and Dietterich, 2019; Xie and Yuille, 2020).
• Self-Attention : adding self-attention layers to models improves robustness (Hendrycks et al., 2019b).
• Diverse Data Augmentation : robustness can increase through data augmentation (Yin et al., 2019).
Pretraining : pretraining on larger and more diverse datasets improves robustness (Orhan, 2019; Hendrycks et al., 2019a).
• Texture Bias : convolutional networks are biased towards texture, which harms robustness (Geirhos et al., 2019).
• Only IID Accuracy Matters : accuracy on independent and identically distributed test data entirely determines natural robustness.
• Synthetic (cid:54) =
⇒
Real : synthetic robustness interventions including diverse data augmentations do not help with robustness on real-world distribution shifts (Taori et al., 2020).
It has been difﬁcult to arbitrate these hypotheses because existing robustness datasets preclude the possibility of controlled experiments by varying multiple aspects simultaneously.
For instance,
Texture Bias was initially investigated with synthetic distortions (Geirhos et al., 2018), which conﬂicts with the Synthetic (cid:54) =
⇒ Real hypothesis.
On the other hand, natural distribution shifts often affect many factors (e.g., time, camera, location, etc.) simultaneously in unknown ways (Recht et al., 2019;
Hendrycks et al., 2019b).
Existing datasets also lack diversity such that it is hard to extrapolate which methods will improve robustness more broadly.
To address these issues and test the seven hypotheses outlined above, we introduce three new robustness benchmarks and a new data augmentation method.
First we introduce ImageNet-Renditions (ImageNet-R), a 30,000 image test set containing various renditions (e.g., paintings, embroidery, etc.)
of ImageNet object classes.
These renditions are naturally occurring, with textures and local image statistics unlike those of ImageNet images, allowing us to more cleanly separate the Texture Bias and Synthetic (cid:54) =
⇒ Real hypotheses.
Next, we investigate natural shifts in the image capture process with StreetView StoreFronts (SVSF) and DeepFashion Remixed (DFR).
SVSF contains business storefront images taken from Google
Streetview, along with metadata allowing us to vary location, year, and even the camera type.
DFR leverages the metadata from DeepFashion2 (Ge et al., 2019) to systematically shift object occlusion, orientation, zoom, and scale at test time.
Both SVSF and DFR provide distribution shift controls and do not alter texture, which remove possible confounding variables affecting prior benchmarks.
Finally, we contribute DeepAugment to increase robustness to some new types of distribution shift.
This augmentation technique uses image-to-image neural networks for data augmentation, not data-independent Euclidean augmentations like image shearing or rotating as in previous work.
DeepAugment achieves state-of-the-art robustness on our newly introduced ImageNet-R benchmark and a corruption robustness benchmark.
DeepAugment can also be combined with other augmentation methods to outperform a model pretrained on 1000 × more labeled data.
After examining our results on these three datasets and others, we can rule out several of the above hypotheses while strengthening support for others.
As one example, we ﬁnd that synthetic data augmentation robustness interventions improve accuracy on ImageNet-R and real-world image blur distribution shifts, providing clear counterexamples to Synthetic (cid:54) =
⇒
Real while lending support to the Diverse Data Augmentation and Texture Bias hypotheses.
In the conclusion, we summarize the various strands of evidence for and against each hypothesis.
Across our many experiments, we do not ﬁnd a general method that consistently improves robustness, and some hypotheses require additional qualiﬁcations.
While robustness is often spoken of and measured as a single scalar property like accuracy, our investigations suggest that robustness is not so simple.
In light of our results, we hypothesize in the conclusion that robustness is multivariate .
R ELATED W ORK
Robustness Benchmarks.
Recent works (Hendrycks and Dietterich, 2019; Recht et al., 2019;
Hendrycks et al., 2020a) have begun to characterize model performance on out-of-distribution (OOD) data with various new test sets, with dissonant ﬁndings.
For instance, Hendrycks et al.
(2020a) demonstrate that modern language processing models are moderately robust to numerous naturally occurring distribution shifts, and that Only IID Accuracy Matters is inaccurate for natural language tasks.
For image recognition, Hendrycks and Dietterich (2019) analyze image models and show
[Figure]
that to simulated corruptions (
Recht et al.
(2019) reproduce the ImageNet (Russakovsky et al., 2015) validation set for use as a benchmark of naturally occurring distribution shift in computer vision.
Their evaluations show a 11-14% drop in accuracy from ImageNet to the new validation set, named ImageNetV2, across a wide range of architectures.
Taori et al.
(2020) use ImageNetV2 to measure natural robustness and dismiss Diverse Data Augmentation .
Recently, Engstrom et al.
(2020) identify statistical biases in
ImageNetV2’s construction, and they estimate that reweighting ImageNetV2 to correct for these biases results in a less substantial 3.6% drop.
Data Augmentation.
Geirhos et al.
; Yin et al.
; Hendrycks et al.
(2020b) demonstrate that data augmentation can improve robustness on ImageNet-C. The space of augmentations that help robustness includes various types of noise (Madry et al., 2017;
Rusak et al., 2020; Lopes et al., 2019), highly unnatural image transformations (Geirhos et al., 2019;
Yun et al., 2019; Zhang et al., 2017), or compositions of simple image transformations such as Python Imaging Library operations (Cubuk et al., 2018;
Hendrycks et al., 2020b).
Some of these augmentations can improve accuracy on in-distribution examples as well as on out-of-distribution (OOD) examples.
N EW B ENCHMARKS
In order to evaluate the seven robustness hypotheses, we introduce three new benchmarks that capture new types of naturally occurring distribution shifts.
ImageNet-Renditions (ImageNet-R) is a newly collected test set intended for ImageNet classiﬁers, whereas StreetView StoreFronts (SVSF) and
DeepFashion Remixed (DFR) each contain their own training sets and multiple test sets.
SVSF and
DFR split data into a training and test sets based on various image attributes stored in the metadata.
For example, we can select a test set with images produced by a camera different from the training set camera.
We now describe the structure and collection of each dataset.
3. I MAGE N ET -R ENDITIONS (I MAGE N ET -R)
While current classiﬁers can learn some aspects of an object’s shape (Mordvintsev et al., 2015), they nonetheless rely heavily on natural textural cues (Geirhos et al., 2019).
In contrast, human vision can process abstract visual renditions.
For example, humans can recognize visual scenes from line drawings as quickly and accurately as they can from photographs (Biederman and Ju, 1988).
Even some primates species have demonstrated the ability to recognize shape through line drawings (Itakura, 1994; Tanaka, 2006).
To measure generalization to various abstract visual renditions, we create the ImageNet-Rendition (ImageNet-R) dataset.
ImageNet-R contains various artistic renditions of object classes from the original ImageNet dataset.
Note the original ImageNet dataset discouraged such images since annotators were instructed to collect “photos only, no painting, no drawings, etc.”
(Deng, 2012).
We do the opposite.
Data Collection.
ImageNet-R contains 30,000 image renditions for 200 ImageNet classes.
We choose a subset of the ImageNet-1K classes, following Hendrycks et al. (2019b), for several reasons. A handful ImageNet classes already have many renditions, such as “triceratops.” We also choose a subset so that model misclassiﬁcations are egregious and to reduce label noise.
The 200 class subset was also chosen based on rendition prevalence, as “strawberry” renditions were easier to obtain than “radiator” renditions. Were we to use all 1,000 ImageNet classes, annotators would be pressed to distinguish between Norwich terrier renditions as Norfolk terrier renditions, which is difﬁcult. We collect images primarily from Flickr and use queries such as “art,” “cartoon,” “grafﬁti,” “embroidery,” “graphics,” “origami,” “painting,” “pattern,” “plastic object,” “plush object,” “sculpture,” “line drawing,” “tattoo,” “toy,” “video game,” and so on.
Images are ﬁltered by Amazon MTurk annotators using a modiﬁed collection interface from ImageNetV2 (Recht et al., 2019).
For instance, after scraping Flickr images with the query “lighthouse cartoon,” we have MTurk annotators select true positive lighthouse renditions. Finally, as a second round of quality control, graduate students manually ﬁlter the resulting images and ensure that individual images have correct labels and do not contain multiple labels. Examples are depicted in Figure 2.
ImageNet-R also includes the line drawings from Wang et al.
(2019), excluding horizontally mirrored duplicate images, pitch black images, and images from the incorrectly collected “pirate ship” class.
3. S TREET V IEW S TORE F RONTS (SVSF)
Computer vision applications often rely on data from complex pipelines that span different hardware, times, and geographies.
Ambient variations in this pipeline may result in unexpected performance degradation, such as degradations experienced by health care providers in Thailand deploying laboratory-tuned diabetic retinopathy classiﬁers in the ﬁeld (Beede et al., 2020).
In order to study the effects of shifts in the image capture process we collect the StreetView StoreFronts (SVSF) dataset, a new image classiﬁcation dataset sampled from Google StreetView imagery (Anguelov et al., 2010) focusing on three distribution shift sources: country, year, and camera.
Data Collection.
SVSF consists of cropped images of business store fronts extracted from
StreetView images by an object detection model.
Each store front image is assigned the class label of the associated Google Maps business listing through a combination of machine learning models and human annotators.
We combine several visually similar business types (e.g. drugstores and pharmacies) for a total of 20 classes, listed Appendix B.
Splitting the data along the three metadata attributes of country, year, and camera, we create one training set and ﬁve test sets.
We sample a training set and an in-distribution test set (200K and 10K images, respectively) from images taken in US/Mexico/Canada during 2019 using a “new” camera system.
We then sample four OOD test sets (10K images each) which alter one attribute at a time while keeping the other two attributes consistent with the training distribution.
Our test sets are year: 2017, 2018; country: France; and camera: “old.”
3. D EEP F ASHION R EMIXED
Changes in day-to-day camera operation can cause shifts in attributes such as object size, object occlusion, camera viewpoint, and camera zoom.
To measure this, we repurpose DeepFashion2 (Ge et al., 2019) to create the DeepFashion Remixed (DFR) dataset.
We designate a training set with 48K images and create eight out-of-distribution test sets to measure performance under shifts in object size, object occlusion, camera viewpoint, and camera zoom-in.
DeepFashion Remixed is a multi-label classiﬁcation task since images may contain more than one clothing item per image.
Data Collection.
Similar to SVSF, we ﬁx one value for each of the four metadata attributes in the training distribution.
Speciﬁcally, the DFR training set contains images with medium scale, medium occlusion, side/back viewpoint, and no zoom-in.
After sampling an IID test set, we construct eight
OOD test distributions by altering one attribute at a time, obtaining test sets with minimal and heavy occlusion; small and large scale; frontal and not-worn viewpoints; and medium and large zoom-in.
See Appendix B for details on test set sizes.
D EEP A UGMENT
In order to further explore the Diverse Data Augmentation hypothesis, we introduce a new data augmentation technique.
Whereas most previous data augmentations techniques use simple augmentation primitives applied to the raw image itself, we introduce DeepAugment, which distorts images by perturbing internal representations of deep networks. DeepAugment works by passing a clean image through an image-to-image network and introducing several perturbations during the forward pass.
These perturbations are randomly sampled from a set of manually designed functions and applied to the network weights and to the feed-forward signal at random layers. For example, our set of perturbations includes zeroing, negating, convolving, transposing, applying activation functions, and more.
This setup generates semantically consistent images with unique and diverse distortions Figure 3.
Although our set of perturbations is designed with random operations, we show that DeepAugment still outperforms other methods on benchmarks such as ImageNet-C and ImageNet-R. We provide the pseudocode in Appendix C. For our experiments, we speciﬁcally use the CAE (Theis et al., 2017) and EDSR (Lim et al., 2017) architectures as the basis for DeepAugment. CAE is an autoencoder architecture, and EDSR is a superresolution architecture. These two architectures show the DeepAugment approach works with different architectures.
Each clean image in the original dataset and passed through the network and is thereby stochastically distored, resulting in two distorted versions of the clean dataset (one for CAE and one for EDSR). We then train on the augmented and clean data simultaneously and call this approach DeepAugment. [Table]
ResNet-
[Table]
+ ImageNet-21K Pretraining ( 10 × labeled data)
[Table]
+ CBAM ( Self-Attention )
[Table]
+ (cid:96) ∞
Adversarial Training
[Table]
+ Speckle Noise
[Table]
+ Style Transfer Augmentation
[Table]
+ AugMix
[Table]
+ DeepAugment
[Table]
+ DeepAugment + AugMix
[Table]
ResNet-152 ( Larger Models )
[Table]
ImageNet-21K Pretraining tests Pretraining and CBAM tests Self-Attention .
Style Transfer, AugMix, and DeepAugment test Diverse Data Augmentation in contrast to simpler noise augmentations such as (cid:96) ∞ Adversarial Noise and Speckle Noise.
While there remains much room for improvement, results indicate that progress on ImageNet-R is tractable.
E XPERIMENTS 5. S ETUP
In this section we brieﬂy describe the evaluated models, pretraining techniques, self-attention mechanisms, data augmentation methods, and note various implementation details.
Model Architectures and Sizes.
Most experiments are evaluated on a standard ResNet-50 model (He et al., 2015).
Model size evaluations use ResNets or ResNeXts (Xie et al., 2016) of varying sizes.
Pretraining.
For pretraining we use ImageNet-21K which contains approximately 21,000 classes and approximately 14 million labeled training images, or around 10 × more labeled training data than
ImageNet-1K. We tune Kolesnikov et al.
(2019)’s
ImageNet-21K model.
We also use a large pretrained ResNeXt-101 model from Mahajan et al.
This was pre-trained on on approximatelybillion Instagram images with hashtag labels and ﬁne-tuned on ImageNet-1K.
This Weakly Supervised
Learning (WSL) pretraining strategy uses approximately 1000 × more labeled data.
Self-Attention.
When studying self-attention, we employ CBAM (Woo et al., 2018) and SE (Hu et al., 2018) modules, two forms of self-attention that help models learn spatially distant dependencies.
Data Augmentation.
We use Style Transfer, AugMix, and DeepAugment to analyze the Diverse
Data Augmentation hypothesis, and we contrast their performance with simpler noise augmentations such as Speckle Noise and adversarial noise.
Style transfer (Geirhos et al., 2019) uses a style transfer network to apply artwork styles to training images.
We use AugMix (Hendrycks et al., 2020b) which randomly composes simple augmentation operations (e.g., translate, posterize, solarize).
DeepAugment, introduced above, distorts the weights and feedforward passes of image-to-image models to generate image augmentations.
Speckle Noise data augmentation muliplies each pixel by (1 + x ) with x sampled from a normal distribution (Rusak et al., 2020; Hendrycks and Dietterich, 2019).
We also consider adversarial training as a form of adaptive data augmentation and use the model from Wong et al.
(2020) trained against (cid:96) ∞ perturbations of size ε = 4 / 255 .
5. R ESULTS
We now perform experiments on ImageNet-R, StreetView StoreFronts, DeepFashion Remixed.
We also evaluate on ImageNet-C and compare and contrast it with real distribution shifts.
ImageNet-R. Table 1 shows performance on ImageNet-R as well as on ImageNet-200 (the original
ImageNet data restricted to ImageNet-R’s 200 classes).
This has several implications regarding the four method-speciﬁc hypotheses.
Pretraining with ImageNet-21K (approximately 10 × labeled data) hardly helps.
Appendix A shows WSL pretraining can help, but Instagram has renditions, while ImageNet excludes them; hence we conclude comparable pretraining was ineffective.
Notice
Self-Attention increases the IID/OOD gap.
Compared to simpler data augmentation techniques such as Speckle Noise, the Diverse Data Augmentation techniques of Style Transfer, AugMix, and
DeepAugment improve generalization.
Note AugMix and DeepAugment improve in-distribution performance whereas Style transfer hurts it.
Also, our new DeepAugment technique is the best standalone method with an error rate of 57.8%.
Last, Larger Models reduce the IID/OOD gap.
Regarding the three more abstract hypotheses, biasing networks away from natural textures through diverse data augmentation improved performance, so we ﬁnd support for the Texture Bias hypothesis.
The IID/OOD generalization gap varies greatly which condtradicts Only IID Accuracy Matters .
Finally, since ImageNet-R contains real-world examples, and since synthetic data augmentation helps on ImageNet-R, we now have clear evidence against the Synthetic (cid:54) =
⇒ Real hypothesis.
StreetView StoreFronts.
In Table 2, we evaluate data augmentation methods on SVSF and ﬁnd that all of the tested methods have mostly similar performance and that no method helps much on country shift, where error rates roughly double across the board.
Here evaluation is limited to augmentations due to a 30 day retention window for each instantiation of the dataset.
Images captured in France contain noticeably different architectural styles and storefront designs than those captured in US/Mexico/Canada; meanwhile, we are unable to ﬁnd conspicuous and consistent indicators of the camera and year.
This may explain the relative insensitivity of evaluated methods to the camera and year shifts.
Overall Diverse Data Augmentation shows limited beneﬁt, suggesting either that data augmentation primarily helps combat texture bias as with ImageNet-R, or that existing augmentations are not diverse enough to capture high-level semantic shifts such as building architecture. [Table] + [Table]
[Table]
DeepFashion Remixed.
Table 3 shows our experimental ﬁndings on DFR, in which all evaluated methods have an average OOD mAP that is close to the baseline.
In fact, most OOD mAP increases track IID mAP increases.
In general, DFR’s size and occlusion shifts hurt performance the most.
We also evaluate with Random Erasure augmentation, which deletes rectangles within the image, to simulate occlusion (Zhong et al., 2017).
Random Erasure improved occlusion performance, but
Style Transfer helped even more.
Nothing substantially improved OOD performance beyond what is explained by IID performance, so here it would appear that Only IID Accuracy Matters . Our results do not provide clear evidence for the Larger Models , Self-Attention , Diverse Data Augmentation , and
Pretraining hypotheses. ImageNet-C. We now consider a previous robustness benchmark to reassess all seven hypotheses.
We use the ImageNet-C dataset (Hendrycks and Dietterich, 2019) which applies 15 common image
Corruption Severity
I m a g e N e t - C A cc u r a c y ( % ) ImageNet-C Error Across Severities ResNetStyle Transfer
DeepAugment+AugMix ImageNet Accuracy (%) I m a g e N e t - C A cc u r a c y ( % )
IID vs. OOD Generalization +1000x Labeled Data (WSL)
+DeepAugment+AugMix ResNet ResNeXt corruptions (e.g., Gaussian noise, defocus blur, simulated fog, JPEG compression, etc.) across 5 severities to ImageNet-1K validation images. We ﬁnd that DeepAugment improves robustness on ImageNet-C. Figure 4 shows that when models are trained with AugMix and DeepAugment, they attain the state-of-the-art, break the trendline, and exceed the corruption robustness provided by training on 1000 × more labeled training data.
Note the augmentations from AugMix and DeepAugment are disjoint from ImageNet-C’s corruptions.
Full results are shown in Appendix A’s Table 8.
This is evidence against the Only IID Accuracy Matters hypothesis and is evidence for the
Larger Models , Self-Attention , Diverse Data Augmentation , Pretraining , and Texture Bias hypotheses.
Taori et al.
(2020) remind us that ImageNet-C uses various synthetic corruptions and suggest that they are divorced from real-world robustness.
Real-world robustness requires generalizing to naturally occurring corruptions such as snow, fog, blur, low-lighting noise, and so on, but it is an open question whether ImageNet-C’s simulated corruptions meaningfully approximate real-world corruptions.
For our results analysis, we collect a small dataset of 1,000 real-world blurry images and ﬁnd that
ImageNet-C can track robustness to real-world corruptions.
We collect the “Real Blurry Images” dataset with Flickr and query ImageNet object class names concatenated with the word “blurry.”
Examples are in Figure 5.
We then evaluate various models on real-world blurry images and ﬁnd that all the robustness interventions that help with ImageNet-C also help with real-world blurry images.
Hence ImageNet-C can track performance on real-world corruptions.
Moreover, DeepAugment+AugMix has the lowest error rate on Real Blurry Images, which again contradicts the Synthetic (cid:54) =
⇒ Real hypothesis.
The upshot is that ImageNet-C is a controlled and systematic proxy for real-world robustness.
We collect 1,000 blurry images to see whether improvements on ImageNet-C’s simulated blurs correspond to improvements on real-world blurry images.
Each image belongs to an ImageNet
[Table] + + + − [Table] + + − −
[Table]
+ + + − −
[Table]
+ + − −
Evidence for is denoted “ + ”, and “ − ” denotes an absence of evidence or evidence against.
class.
Results from Table 5 show that Larger Models , Self-Attention , Diverse Data Augmentation ,
Pretraining all help, just like ImageNet-C.
Here DeepAugment+AugMix attains state-of-the-art.
These results suggest ImageNet-C’s simulated corruptions track real-world corruptions.
In hindsight, this is expected since various computer vision problems have used synthetic corruptions as proxies for real-world corruptions, for decades.
In short, ImageNet-C is a diverse and systematic benchmark that is correlated with improvements on real-world corruptions.
C ONCLUSION
In this paper we introduced three new benchmarks, ImageNet-Renditions, DeepFashion Remixed, and
StreetView StoreFronts.
With these benchmarks, we thoroughly tested seven robustness hypotheses– four about methods for robustness, and three about the nature of robustness.
Let us consider the ﬁrst four hypotheses, using the new information from ImageNet-C and our three new benchmarks.
The Larger Models hypothesis was supported with ImageNet-C and ImageNet-R, but not with DFR.
While Self-Attention noticeably helped ImageNet-C, it did not help with ImageNetR and DFR.
Diverse Data Augmentation was ineffective for SVSF and DFR, but it greatly improved
ImageNet-C and ImageNet-R accuracy.
Pretraining greatly helped with ImageNet-C but hardly helped with DFR and ImageNet-R. This is summarized in Table 4.
It was not obvious a priori that synthetic Diverse Data Augmentation could improve ImageNet-R accuracy, nor did previous research suggest that Pretraining would sometimes be ineffective.
While no single method consistently helped across all distribution shifts, some helped more than others.
Our analysis of these four hypotheses have implications for the remaining three hypotheses.
Regarding Texture Bias , ImageNet-R shows that networks do not generalize well to renditions (which have different textures), but that diverse data augmentation (which often distorts textures) can recover accuracy.
More generally, larger models and diverse data augmentation consistently helped on ImageNet-R, ImageNet-C, and Blurry Images, suggesting that these two interventions reduce texture bias.
However, these methods helped little for geographic shifts, showing that there is more to robustness than texture bias alone.
Regarding Only IID Accuracy Matters , while IID accuracy is a strong predictor of OOD accuracy, it is not decisive—Table 4 shows that many methods improve robustness across multiple distribution shifts, and recent experiments in NLP provide further counterexamples (Hendrycks et al., 2020a).
Finally, Synthetic (cid:54) =
⇒ Real has clear counterexamples given that DeepAugment greatly increases accuracy on ImageNet-R and Real Blurry Images.
In summary, some previous hypotheses are implausible, and the Texture Bias hypothesis has the most support.
Our seven hypotheses presented several conﬂicting accounts of robustness.
What led to this conﬂict?
We suspect it is because robustness is not one scalar like accuracy.
The research community is reasonable in judging IID accuracy with a univariate metric like ImageNet classiﬁcation accuracy, as models with higher ImageNet accuracy reliably have better ﬁne-tuned classiﬁcation accuracy on other tasks (Kornblith et al., 2018).
In contrast, we argue it is too simplistic to judge OOD accuracy with a univariate metric like, say, ImageNetV2 or ImageNet-C accuracy.
Instead we hypothesize that robustness is multivariate.
This Multivariate hypothesis means that there is not a single scalar model property that wholly governs natural model robustness.
If robustness has many faces, future work should evaluate robustness using many distribution shifts; for example, ImageNet models should at least be tested against ImageNet-C and ImageNet-R. Future work could further characterize the space of distribution shifts.
However, due to this paper, there are now more out-of-distribution robustness datasets than there are published robustness methods.
Hence the research community should prioritize creating new robustness methods.
If our Multivariate hypothesis is true, research should shift toward using multiple tests to develop models that are both robust and safe.
A A DDITIONAL R ESULTS
ImageNet-R. Expanded ImageNet-R results are in Table 7. [Figure]
WSL pretraining on Instagram images appears to yield dramatic improvements on ImageNet-R, but the authors note the prevalence of artistic renditions of object classes on the Instagram platform.
While ImageNet’s data collection process actively excluded renditions, we do not have reason to believe the Instagram dataset excluded renditions.
On a ResNeXt-101 32 × 8d model, WSL pretraining improves ImageNet-R performance by a massive 5% from 57.5% top-1 error to 24.2%.
Ultimately, without examining the training images we are unable to determine whether ImageNet-R represents an actual distribution shift to the Instagram WSL models.
However, we also observe that with greater controls, that is with ImageNet21K pre-training, pretraining hardly helped ImageNet performance, so it is not clear that more pretraining data improves ImageNet-R performance
Increasing model size appears to automatically improve ImageNet-R performance, as shown in Figure 6.
A ResNet50 (25.5M parameters) has 63.9% error, while a ResNet152 (60M) has 58.7% error.
ResNeXt-50 32 × 4d (25.0M) attains 62.3% error and ResNeXt-101 32 × 8d (88M) attains 57.5% error.
ImageNet-C. Expanded ImageNet-C results are Table 8.
We also tested whether model size improves performance on ImageNet-C for even larger models.
With a different codebase, we trained ResNet-50, ResNet-152, and ResNet-500 models which achieved 80.6, 74.0, and 68.5 mCE respectively. Expanded comparisons between ImageNet-C and Real Blurry Images is in Table 5. [Table] +
[Table] ∞ Adversarial Training [Table] Speckle Noise
[Table]
+ Style Transfer
[Table]
+ AugMix
[Table]
ImageNet-A. ImageNet-A (Hendrycks et al., 2019b) is an adversarially ﬁltered test set and is constructed based on existing model weaknesses (see (Wang et al., 2020) for another robustness dataset algorithmically determined by model weaknesses).
This dataset contains examples that are difﬁcult for a ResNet-50 to classify, so examples solvable by simple spurious cues are are especially infrequent in this dataset.
Results are in Table 9.
Notice Res2Net architectures (Gao et al., 2019b) can greatly improve accuracy.
Results also show that Larger Models , Self-Attention , and Pretraining help, while Diverse Data Augmentation usually does not help substantially.
Implications for the Four Method Hypotheses.
The Larger Models hypothesis has support with ImageNet-C ( + ),
ImageNet-A ( + ), ImageNet-R ( + ), yet does not markedly improve DFR ( − ) performance.
The Self-Attention hypothesis has support with ImageNet-C ( + ), ImageNet-A ( + ), yet does not help
ImageNet-R ( − ) and DFR ( − ) performance.
The Diverse Data Augmentation hypothesis has support with ImageNet-C ( + ), ImageNet-R ( + ), yet does not markedly improve ImageNet-A ( − ), DFR( − ), nor SVSF ( − ) performance.
The Pretraining hypothesis has support with ImageNet-C ( + ), ImageNet-A ( + ), yet does not markedly improve DFR ( − ) nor ImageNet-R ( − ) performance.
Hypothesis
ImageNet-C
ImageNet-A
ImageNet-R
DFR
SVSF
Larger Models
[Equation]
− Self-Attention + + − −
Diverse Data Augmentation + − + − −
[Table] + + − −
ImageNet
[Table]
ImageNet-
[Table]
Gap
ResNet-50 (He et al., 2015) 7.
+ ImageNet-21K Pretraining ( 10 × data) 7.
+ CBAM ( Self-Attention ) 7.
+ (cid:96) ∞
Adversarial Training 25.
+ Speckle Noise 8.
+ Style Transfer 8.
+ AugMix 7.
+ DeepAugment 7.
+ DeepAugment + AugMix 8.
ResNet-101 ( Larger Models ) 7.
+ SE ( Self-Attention ) 6.
ResNet-152 ( Larger Models ) 6.
+ SE ( Self-Attention ) 6.
ResNeXt-101 32 × 4d ( Larger Models ) 6.
+ SE ( Self-Attention ) 5.
ResNeXt-101 32 × 8d ( Larger Models ) 6.
+ WSL Pretraining ( 1000 × data) 4.
+ DeepAugment + AugMix 6. data, and Style Transfer, AugMix, and DeepAugment provide support for the Diverse Data Augmentation hypothesis
[Table]
[Table] [Table]
[Table] [Table]
B F URTHER D ATASET D ESCRIPTIONS
ImageNet-R Classes.
The 200 ImageNet classes and their WordNet IDs in ImageNet-R are as follows.
Goldﬁsh, great white shark, hammerhead, stingray, hen, ostrich, goldﬁnch, junco, bald eagle, vulture, newt, axolotl, tree frog, iguana,
African chameleon, cobra, scorpion, tarantula, centipede, peacock, lorikeet, hummingbird, toucan, duck, goose, black swan, koala, jellyﬁsh, snail, lobster, hermit crab, ﬂamingo, american egret, pelican, king penguin, grey whale, killer whale, sea lion, chihuahua, shih tzu, afghan hound, basset hound, beagle, bloodhound, italian greyhound, whippet, weimaraner, yorkshire terrier, boston terrier, scottish terrier, west highland white terrier, golden retriever, labrador retriever, cocker spaniels, collie, border collie, rottweiler, german shepherd dog, boxer, french bulldog, saint bernard, husky, dalmatian, pug, pomeranian, chow chow, pembroke welsh corgi, toy poodle, standard poodle, timber wolf, hyena, red fox, tabby cat, leopard, snow leopard, lion, tiger, cheetah, polar bear, meerkat, ladybug, ﬂy, bee, ant, grasshopper, cockroach, mantis, dragonﬂy, monarch butterﬂy, starﬁsh, wood rabbit, porcupine, fox squirrel, beaver, guinea pig, zebra, pig, hippopotamus, bison, gazelle, llama, skunk, badger, orangutan, gorilla, chimpanzee, gibbon, baboon, panda, eel, clown ﬁsh, puffer ﬁsh, accordion, ambulance, assault riﬂe, backpack, barn, wheelbarrow, basketball, bathtub, lighthouse, beer glass, binoculars, birdhouse, bow tie, broom, bucket, cauldron, candle, cannon, canoe, carousel, castle, mobile phone, cowboy hat, electric guitar, ﬁre engine, ﬂute, gasmask, grand piano, guillotine, hammer, harmonica, harp, hatchet, jeep, joystick, lab coat, lawn mower, lipstick, mailbox, missile, mitten, parachute, pickup truck, pirate ship, revolver, rugby ball, sandal, saxophone, school bus, schooner, shield, soccer ball, space shuttle, spider web, steam locomotive, scarf, submarine, tank, tennis ball, tractor, trombone, vase, violin, military aircraft, wine bottle, ice cream, bagel, pretzel, cheeseburger, hotdog, cabbage, broccoli, cucumber, bell pepper, mushroom,
Granny Smith, strawberry, lemon, pineapple, banana, pomegranate, pizza, burrito, espresso, volcano, baseball player, scuba diver, acorn.
n01443537, n01484850, n01494475, n01498041, n01514859, n01518878, n01531178, n01534433, n01614925, n01616318, n01630670, n01632777, n01644373, n01677366, n01694178, n01748264, n01770393, n01774750, n01784675, n01806143, n01820546, n01833805, n01843383, n01847000, n01855672, n01860187, n01882714, n01910747, n01944390, n01983481, n01986214, n02007558, n02009912, n02051845, n02056570, n02066245, n02071294, n02077923, n02085620, n02086240, n02088094, n02088238, n02088364, n02088466, n02091032, n02091134, n02092339, n02094433, n02096585, n02097298, n02098286, n02099601, n02099712, n02102318, n02106030, n02106166, n02106550, n02106662, n02108089, n02108915, n02109525, n02110185, n02110341, n02110958, n02112018, n02112137, n02113023, n02113624, n02113799, n02114367, n02117135, n02119022, n02123045, n02128385, n02128757, n02129165, n02129604, n02130308, n02134084, n02138441, n02165456, n02190166, n02206856, n02219486, n02226429, n02233338, n02236044, n02268443, n02279972, n02317335, n02325366, n02346627, n02356798, n02363005, n02364673, n02391049, n02395406, n02398521, n02410509, n02423022, n02437616, n02445715, n02447366, n02480495, n02480855, n02481823, n02483362, n02486410, n02510455, n02526121, n02607072, n02655020, n02672831, n02701002, n02749479, n02769748, n02793495, n02797295, n02802426, n02808440, n02814860, n02823750, n02841315, n02843684, n02883205, n02906734, n02909870, n02939185, n02948072, n02950826, n02951358, n02966193, n02980441, n02992529, n03124170, n03272010, n03345487, n03372029, n03424325, n03452741, n03467068, n03481172, n03494278, n03495258, n03498962, n03594945, n03602883, n03630383, n03649909, n03676483, n03710193, n03773504, n03775071, n03888257, n03930630, n03947888, n04086273, n04118538, n04133789, n04141076, n04146614, n04147183, n04192698, n04254680, n04266014, n04275548, n04310018, n04325704, n04347754, n04389033, n04409515, n04465501, n04487394, n04522168, n04536866, n04552348, n04591713, n07614500, n07693725, n07695742, n07697313, n07697537, n07714571, n07714990, n07718472, n07720875, n07734744, n07742313, n07745940, n07749582, n07753275, n07753592, n07768694, n07873807, n07880968, n07920052, n09472597, n09835506, n10565667, n12267677.
SVSF.
The classes are
• auto shop • bakery • bank • beauty salon • car dealer • car wash • cell phone store • dentist • discount store • dry cleaner • furniture store • gas station • gym • hardware store • hotel • liquor store • pharmacy • religious institution • storage facility • veterinary care.
DeepFashion Remixed.
The classes are
• short sleeve top • long sleeve top • short sleeve outerwear • long sleeve outerwear • vest • sling • shorts •
[Table]
Size (small, moderate, or large) deﬁnes how much of the image the article of clothing takes up.
Occlusion (slight, medium, or heavy) deﬁnes the degree to which the object is occluded from the camera.
Viewpoint (front, side/back, or not worn) deﬁnes the camera position relative to the article of clothing.
Zoom (no zoom, medium, or large) deﬁnes how much camera zoom was used to take the picture.
[Table]
grafﬁti [Table] embroidery, graphics, origami,
[Table]
sketches
[Table]
tattoos
[Table] [Table] [Table]
C D EEP A UGMENT D ETAILS
Pseudocode.
Below is Pythonic pseudocode for DeepAugment.
The basic structure of DeepAugment is agnostic to the backbone network used, but speciﬁcs such as which layers are chosen for various transforms may vary as the backbone architecture varies.
We do not need to train many different image-to-image models to get diverse distortions (Zhang et al., 2018; Lee et al., 2020).
We only use two existing models, the EDSR super-resolution model (Lim et al., 2017) and the CAE image compression model (Theis et al., 2017).
See full code for such details.
At a high level, DeepAugment processes each image with an image-to-image network.
The image-toimage network’s weights and feedforward activations are distorted with each pass.
The distortion is made possible by, for example, negating the network’s weights and applying dropout to the feedforward activations.
These modiﬁcations were not carefully chosen and demonstrate the utility of mixing together diverse operations without tuning.
The resulting image is distorted and saved.
This process generates an augmented dataset.
7 8 def deepAugment : weights = load_clean_weights() weight_distortions
=
sample_weight_distortions() for d in weight_distortions: weights = apply_distortion(d
) return weights 14 15 def sample_weight_distortions(): distortions = [ negate_weights, zero_weights, flip_transpose_weights, ...
] 22return random_subset(distortions) 24 25 def sample_signal_distortions(): distortions =
[ gelu, negate_signal_random_mask, flip_signal, ...
] 32return random_subset(distortions) 3436 class Network( : def apply_ # Apply given weight tensors to network 39# Clean forward pass.
Compare to deepAugment_forwardPass() def clean_forwardPass(X):
X = network.block1(X)
X = network.block2(X) ...
X = network.blockN(X) return X 47# Our forward pass.
Compare to clean_forwardPass() def deepAugment_forwardPass(X : # Returns a list of distortions, each of which # will be applied at a different layer.
signal_ distortions() 
 apply distortions distortions)
62return X
Ablations.
We run ablations on DeepAugment to understand the contributions from the EDSR and CAE models independently.
Table 13 contains results of these experiments on ImageNet-R and
Table 12 contains results of these experiments on ImageNet-C.
In both tables, “DeepAugment (EDSR)” and “DeepAugment (CAE)” refer to experiments where we only use a single extra augmented training set (+ the standard training set), and train on those images.
[Table]
Noise2Net.
We show that untrained, randomly sampled neural networks can provide useful deep augmentations, highlighting the efﬁcacy of the DeepAugment approach.
While in the main paper we use EDSR and CAE to create DeepAugment augmentations, in this section we explore the use of randomly initialized image-to-image networks to generate diverse image augmentations.
We propose a DeepAugment method, Noise2Net .
In Noise2Net, the architecture and weights are randomly sampled.
Noise2Net is the composition of several residual blocks: Block ( x ) =
x + ε · f Θ ( x ) , where Θ is randomly initialized and ε is a parameter that controls the strength of the augmentation.
For all our experiments, we use 4 Res2Net blocks (Gao et al., 2019a) and ε ∼ U (0 .
The weights of Noise2Net are resampled at every minibatch, and the dilation and kernel sizes of all the convolutions used in Noise2Net are randomly sampled every epoch.
Hence Noise2Net augments an image to an augmented image by processing the image through a randomly sampled network with random weights.
Recall that in the case of EDSR and CAE, we used networks to generate a static dataset, and then we trained normally on that static dataset.
This setup could not be done on-the-ﬂy.
That is because we fed in one example at a time with EDSR and CAE.
If we pass the entire minibatch through EDSR or CAE, we will end up applying the same augmentation to all images in the minibatch, reducing stochasticity and augmentation diversity.
In contrast, Noise2Net enables us to process batches of images on-the-ﬂy and obviates the need for creating a static augmented dataset.
In Noise2Net, each example is processed differently in parallel, so we generate more diverse augmentations in real-time.
To make this possible, we use grouped convolutions.
A grouped convolution with number of groups =
N will take a set of kN channels as input, and apply N independent convolutions on channels { 1 , . . .
, k } , { k + 1 , . .
. , 2 k } , . .
, { ( N − 1) k
+ 1 , . . .
, Nk } .
Given a minibatch of size
B , we can apply a randomly initialized grouped convolution with N = B groups in order to apply a different random convolutional ﬁlter to each element in the batch in a single forward pass.
By replacing all the convolutions in each Res2Net block with a grouped convolution and randomly initializing network weights, we arrive at Noise2Net, a variant of DeepAugment.
See Figure 7 for a high-level overview of Noise2Net and Figure 8 for sample outputs.
We evaluate the Noise2Net variant of DeepAugment on ImageNet-R. Table 13 shows that it outperforms the EDSR and CAE variants of DeepAugment, even though the network architecture is randomly sampled, its weights are random, and the network is not trained.
This demonstrates the ﬂexibility of the DeepAugment approach.
Below is Pythonic pseudocode for training a classiﬁer using the Noise2Net variant of DeepAugment.
[Table]
+ DeepAugment (EDSR)
[Table]
+ DeepAugment (CAE)
[Table]
+ DeepAugment (EDSR + CAE)
[Table]
+ DeepAugment (Noise2Net)
[Table]
+ DeepAugment (All 3)
[Table]
.block3 =
{+Res2NetBlock(batch_size=batch_size) self.block
+}
=
Res2NetBlock(batch_size=
batch_size) 19def reload_weights(self): ...
# Reload Network parameters 22def set_epsilon(self, new_eps): self.epsilon = new_eps 25def forward(self, x): x = x + self.block1(x) * self.epsilon x = x + self.block2(x) *
self.epsilon x = x + self.block3(x) *
self.epsilon x = x + self.block4(x) * self epsilon return x