D EFENDING A GAINST I MAGE C ORRUPTIONS T HROUGH A DVERSARIAL A UGMENTATIONS
Anonymous authors
Paper under double-blind review
A BSTRACT
Modern neural networks excel at image classiﬁcation, yet they remain vulnerable to common image corruptions such as blur, speckle noise or fog.
Recent methods that focus on this problem, such as AugMix and DeepAugment, introduce defenses that operate in expectation over a distribution of image corruptions.
In contrast, the literature on (cid:96) p -norm bounded perturbations focuses on defenses against worst-case corruptions.
In this work, we reconcile both approaches by proposing AdversarialAugment , a technique which optimizes the parameters of image-to-image models to generate adversarially corrupted augmented images.
We theoretically motivate our method and give sufﬁcient conditions for the consistency of its idealized version as well as that of DeepAugment.
Classiﬁers trained using our method in conjunction with prior methods (AugMix & DeepAugment) improve upon the state-of-the-art on common image corruption benchmarks conducted in expectation on C IFAR -10-C and also improve worst-case performance against (cid:96) p -norm bounded perturbations on both C IFAR {+-
+}
and I MAGE N ET .
I NTRODUCTION
By following a process known as Empirical Risk Minimization (ERM) (Vapnik, 1998), neural networks are trained to minimize the average error on a training set.
ERM has enabled breakthroughs in a wide variety of ﬁelds and applications (Goodfellow et al., 2016; Krizhevsky et al., 2012; Hinton et al., 2012), ranging from ranking content on the web (Covington et al., 2016) to autonomous driving (Bojarski et al., 2016) via medical diagnostics (De Fauw et al., 2018).
ERM is based on the principle that the data used during training is independently drawn from the same distribution as the one encountered during deployment.
In practice, however, training and deployment data may differ and models can fail catastrophically.
Such occurrence is commonplace as training data is often collected through a biased process that highlights confounding factors and spurious correlations (Torralba et al., 2011; Kuehlkamp et al., 2017), which can lead to undesirable consequences (e.g., http://gendershades.org ).
As such, it has become increasingly important to ensure that deployed models are robust and generalize to various input corruptions.
Unfortunately, even small corruptions can signiﬁcantly affect the performance of existing classiﬁers.
For example, Recht et al.
; Hendrycks et al.
(2019) show that the accuracy of I MAGE N ET models is severely impacted by changes in the data collection process, while imperceptible deviations to the input, called adversarial perturbations, can cause neural networks to make incorrect predictions with high conﬁdence (Carlini & Wagner, 2017a;b;
Goodfellow et al., 2015; Kurakin et al., 2016; Szegedy et al., 2014).
Methods to counteract such effects, which mainly consist of using random or adversarially-chosen data augmentations, struggle.
Training against corrupted data only forces the memorization of such corruptions and, as a result, these models fail to generalize to new corruptions (Vasiljevic et al., 2016; Geirhos et al., 2018).
Recent work from Hendrycks et al.
(2020b) (also known as AugMix) argues that basic pre-deﬁned corruptions can be composed to improve the robustness of models to common corruptions.
Another line of work, DeepAugment (Hendrycks et al., 2020a), corrupts images by passing them through two speciﬁc image-to-image models while distorting the models’ parameters and activations using an extensive range of manually deﬁned heuristic operations.
While both methods perform well on average on the common corruptions present in C IFAR -10-C and I MAGE N ET -C, they generalize poorly to the adversarial setting.
Most recently, Laidlaw et al.
(2021) proposed an adversarial training
[Figure]
method based on bounding a neural perceptual distance (i.e., an approximation of the true perceptual distance), under the acronym of PAT for Perceptual Adversarial Training.
Their method performs well against ﬁve diverse adversarial attacks, but, as it speciﬁcally addresses robustness to pixel-level attacks that directly manipulate image pixels, it performs worse than AugMix on common corruptions.
In this work, we address this gap.
We focus on training models that are robust to adversarially-chosen corruptions that preserve semantic content.
We go beyond conventional random data augmentation schemes (exempliﬁed by Hendrycks et al.
, 2020b;a) and adversarial training (exempliﬁed by Madry et al., 2018;
Gowal et al., 2019; Laidlaw et al., 2021)
by leveraging image-to-image models that can produce a wide range of semantically-preserving corruptions; in contrast to related works, our method does not require the manual creation of heuristic transformations.
Our contributions are as follows:
• We formulate an adversarial training procedure, named AdversarialAugment (or AdA for short) which ﬁnds adversarial examples by optimizing over the weights of any pre-trained image-to-image model (i.e. over the weights of arbitrary autoencoders).
• We give sufﬁcient conditions for the consistency of idealized versions of our method and DeepAugment, and provide PAC-Bayesian performance guarantees, following Neyshabur et al.
Our theoretical considerations highlight the potential advantages of AdA over previous work (DeepAugment), as well as the combination of the two.
We also establish links to Invariant Risk Minimization (IRM) (Arjovsky et al., 2020), Adversarial Mixing (AdvMix) (Gowal et al., 2019) and Perceptual Adversarial Training (Laidlaw et al., 2021).
• We improve upon the known state-of-the-art on C IFAR -10-C by achieving a mean corruption error (mCE) of 7.83% when using our method in conjunction with others (vs. 23.51% for Perceptual Adversarial Training (PAT), 10.90% for AugMix and 8.11% for DeepAugment).
On I MAGE N ET we show that our method can leverage 4 pre-trained image-to-image models simultaneously (VQVAE (van den Oord et al., 2017), U-Net (Ronneberger et al., 2015), EDSR (Lim et al., 2017) & CAE (Theis et al., 2017)) to yield the largest increase in robustness to common image corruptions, among all evaluated models.
• On (cid:96) 2 and (cid:96) ∞ norm-bounded perturbations we signiﬁcantly improve upon previous work (DeepAugment & AugMix) using AdA (EDSR) , while slightly improving generalization performance on both I MAGE N ET - V 2 and on C IFAR -10.1.
R ELATED W ORK
Data augmentation.
Data augmentation has been shown to reduce the generalization error of standard (non-robust) training.
For image classiﬁcation tasks, random ﬂips, rotations and crops are commonly used (He et al., 2016a).
More sophisticated techniques such as Cutout of DeVries &
Taylor (2017) (which produces random occlusions), CutMix of Yun et al.
(2019) (which replaces parts of an image with another) and mixup of Zhang et al.
(2018a);
Tokozume et al.
(2018) (which linearly interpolates between two images) all demonstrate extremely compelling results.
Guo et al.
(2019) improved upon mixup by proposing an adaptive mixing policy.
Works, such as AutoAugment (Cubuk et al., 2019) and the related RandAugment (Cubuk et al., 2020), learn augmentation policies from data directly.
These methods are tuned to improve standard classiﬁcation accuracy and have been shown to work well on C IFAR -10, C IFAR -100, S VHN and I MAGE N ET .
However, these approaches do not necessarily generalize well to larger data shifts and perform poorly on benign corruptions such as blur or speckle noise (Taori et al., 2020).
Robustness to synthetic and natural data shift.
Several works argue that training against corrupted data only forces the memorization of such corruptions and, as a result, models fail to generalize to new corruptions (Vasiljevic et al., 2016; Geirhos et al., 2018).
This has not prevented Geirhos et al.
; Yin et al.
; Hendrycks et al.
(2020b);
Lopes et al.
; Hendrycks et al.
(2020a)
from demonstrating that some forms of data augmentation can improve the robustness of models on
I MAGE N ET -C, despite not being directly trained on these common corruptions.
Most works on the topic focus on training models that perform well in expectation.
Unfortunately, these models remain vulnerable to more drastic adversarial shifts (Taori et al., 2020).
Robustness to adversarial data shift.
Adversarial data shift has been extensively studied (Goodfellow et al., 2015; Kurakin et al., 2016; Szegedy et al., 2014; Moosavi-Dezfooli et al., 2019; Papernot et al., 2016; Madry et al., 2018).
Most works focus on the robustness of classiﬁers to (cid:96) p -norm bounded perturbations.
In particular, it is expected that a robust classiﬁer should be invariant to small perturbations in the pixel space (as deﬁned by the (cid:96) p -norm).
Goodfellow et al. (2015) and Madry et al.
(2018) laid down foundational principles to train robust networks, and recent works (Zhang et al., 2019; Qin et al., 2019; Rice et al., 2020; Wu et al., 2020; Gowal et al., 2020) continue to ﬁnd novel approaches to enhance adversarial robustness.
However, approaches focused on (cid:96) p -norm bounded perturbations often sacriﬁce accuracy on non-adversarial images (Raghunathan et al., 2019).
Several works (Baluja & Fischer, 2017; Song et al., 2018; Xiao et al., 2018; Qiu et al., 2019; Wong & Kolter, 2021b; Laidlaw et al., 2021) go beyond these analytically deﬁned perturbations and demonstrate that it is not only possible to maintain accuracy on non-adversarial images but also to reduce the effect of spurious correlations and reduce bias (Gowal et al., 2019).
Unfortunately, most aforementioned approaches perform poorly on C IFAR -10-C and I MAGE N ET -C.
D EFENSE A GAINST A DVERSARIAL C ORRUPTIONS
In this section, we introduce AdA , our approach for training models robust to image corruptions through the use of adversarial augmentations while leveraging pre-trained autoencoders.
In
Appendix A we detail how our work relates to AugMix (Hendrycks et al., 2020b), DeepAugment (Hendrycks et al., 2020a), Invariant Risk Minimization (Arjovsky et al., 2020), Adversarial
Mixing (Gowal et al., 2019) and Perceptual Adversarial Training (Laidlaw et al., 2021).
Corrupted adversarial risk.
We consider a model f θ : X → Y parametrized by θ .
Given a dataset D ⊂ X × Y over pairs of examples x and corresponding labels y , we would like to ﬁnd the parameters θ which minimize the corrupted adversarial risk :
[Equation]
where L is a suitable loss function, such as the 0 - 1 loss for classiﬁcation, and C : X → 2 X outputs a corruption set for a given example x .
For example, in the case of an image x , a plausible corruption set C ( x ) could contain blurred, pixelized and noisy variants of x .
In other words, we seek the optimal parameters θ ∗ which minimize the corrupted adversarial risk so that f θ ∗ is invariant to corruptions; that is, f θ ∗ ( x (cid:48) )
=
f θ ∗ ( x ) for all x (cid:48) ∈ C ( x ) .
For example if x is an image classiﬁed to be a horse by f θ ∗ , then this prediction should not be affected by the image being slightly corrupted by camera blur, Poisson noise or JPEG compression artifacts.
AdversarialAugment ( AdA ).
Our method, AdA , uses image-to-image models to generate adversarially corrupted images.
At a high level, this is similar to how DeepAugment works: DeepAugment perturbs the parameters of two speciﬁc image-to-image models using heuristic operators, which are manually deﬁned for each model.
Our method, instead, is more general and optimizes directly over perturbations to the parameters of any pre-trained image-to-image model.
We denote these image-to-image models as corruption networks .
We experiment with four corruption networks: a vector-quantised variational autoencoder ( VQ-VAE ) (van den Oord et al., 2017); a convolutional
U-Net (Ronneberger et al., 2015) trained for image completion ( U-Net ), a super-resolution model ( EDSR )
(Lim et al., 2017) and a compressive autoencoder ( CAE ) (Theis et al., 2017).
The latter two models are used in DeepAugment as well.
Additional details about the corruption networks are provided in the Appendix in section C.
Formally, let c φ : X → X be a corruption network with parameters φ = { φ i } Ki =1 which, when its parameters are perturbed, acts upon clean examples by corrupting them.
Here each φ i corresponds to the vector of parameters in the i -th layer, and K is the number of layers.
Let δ = { δ i } Ki =1 be a weight perturbation set, so that a corrupted variant of x can be generated by c { φ i + δ i } Ki =1 ( x ) .
With a slight abuse of notation, we shorten c { φ i + δ i } Ki =1 to c φ + δ .
Clearly, using unconstrained perturbations can result in exceedingly corrupted images which have lost all discriminative information and are not useful for training.
For example, if c φ is a multi-layer perceptron, trivially setting δ i = − φ i would yield fully zero, uninformative outputs.
Hence, we restrict the corruption sets by deﬁning a maximum relative perturbation radius ν > 0 , and deﬁne the corruption set of AdA as C ( x ) =
{ c φ + δ ( x ) | (cid:107) δ (cid:107) 2 ,φ ≤ ν } , where the norm (cid:107) · (cid:107) 2 ,φ is deﬁned as (cid:107) [Table] (cid:107) [Table]
= [Table] φ i [Equation]
Finding adversarial corruptions.
For a clean image x with label y , a corrupted adversarial example within a bounded corruption distance ν is a corrupted image x (cid:48)
=
c φ + δ ( x ) generated by the corruption network c with bounded parameter offsets (cid:107) δ (cid:107) 2 ,φ ≤ ν which causes f θ to misclassify x : f θ ( x (cid:48) )
(cid:54) =
y .
Similarly to Madry et al.
(2018), we ﬁnd an adversarial corruption by maximizing a surrogate loss ˜ L to L , for example, the cross-entropy loss between the predicted logits of the corrupted image and its clean label.
We optimize over the perturbation δ to c ’s parameters φ :
[Equation]
In practice, we solve this optimization problem (approximately) using projected gradient ascent to enforce that perturbations δ lie within the feasible set (cid:107) δ (cid:107) 2 ,φ ≤ ν .
Examples of corrupted images obtained by AdA are shown in Figure 1.
Adversarial training.
Given the model f parameterized by θ , minimizing the corrupted adversarial risk from (1) results in parameters θ ∗ obtained by solving the following optimization problem:
[Equation]
We also provide a full algorithm listing of our method in Appendix B.
Meaningful corruptions.
A crucial element of AdA is setting the perturbation radius ν to ensure that corruptions are varied enough to constitute a strong defense against common corruptions, while still being meaningful (i.e., without destroying semantics).
We measure the extent of corruption induced by a given ν through the structural similarity index measure (SSIM) (Wang et al., 2004) between clean and corrupted images (details on how SSIM is computed can be found in section E).We plot the distributions of SSIM over various perturbation radii in Figure 2 for corrupted images produced by AdA using two backbones ( EDSR and CAE ) on C IFAR -10.
We ﬁnd that a relative perturbation radius of ν = .
015 yields enough variety in the corruptions for both EDSR and CAE .
This is demonstrated for EDSR by having a large SSIM variance compared to, e.g. ν = 0 .
009375 , without destroying semantic meaning (retaining a high mean SSIM).
We guard against unlikely but too severe corruptions (i.e. with too low SSIM) using an efﬁcient approximate line-search procedure (details can be found Appendix E).
A similar approach for restricting the SSIM values of samples during adversarial training was used by Hameed (2020)
; Hameed & Gy¨orgy (2021).
T HEORETICAL C ONSIDERATIONS
In this section, we present conditions under which simpliﬁed versions of our approach ( AdA ) and previous work (DeepAugment), are consistent (i.e., as the data size grows, the expected error of the learned classiﬁer over random corruptions converges to zero).
The role of this section is two-fold: (1) to show that our algorithm is well-behaved (i.e., it converges); and (2) to introduce and to reason about sufﬁcient assumptions for convergence.
[Figure]
In this section we assume that the classiﬁcation problem we consider is binary (rather than multiclass).
Thus, denoting the parameter space for θ and φ by Θ and Φ , we assume that there exists a ground-truth binary classiﬁer f θ ∗ for some parameter θ ∗ ∈ Θ .
We further assume that the clean input samples come from a distribution µ over X .
To start with
[Figure]
we consider the case when the goal is to have good average performance on some future corruptions; as such, we assume that these corruptions can be described by an unknown distribution α of corruption parameters φ over Φ .
Then, for any θ ∈ Θ , the expected corrupted risk is deﬁned as
[Equation]
which is the expected risk of f θ composed with a random corruption function c φ , φ ∼ α .
Since α is unknown, we cannot directly compute the expected corrupted risk.
DeepAugment overcomes this problem by proposing a suitable replacement distribution β and instead scores classiﬁcation functions by approximating R ( f θ , β ) (rather than R ( f θ , α ) ).
In contrast, AdA searches over a set, which we denote by Φ β ⊆ Φ of corruptions to ﬁnd the worst case, similarly to the adversarial training of Madry et al.
DeepAugment.
The idealized version of DeepAugment (which neglects optimization issues) is deﬁned as (cid:98) θ ( n ) DA = arg min θ ∈ Θ 1 n (cid:80)
ni =1 L ([ f θ ◦ c φ i ]( x i ) , y i ) , where φ i ∼ β for i = 1 , 2 , . . . , n .
The following assumption provides a formal description of a suitable replacement distribution.
Assumption 1.
(Corruption coverage)
There exists a known probability measure β over Φ such that α is absolutely continuous with respect to β (i.e., if α ( W ) > 0 for some W ⊂ Φ then β ( W ) > 0 ) and for all x , f θ ∗ ( x ) =
f θ ∗ ( c φ ( x )) for all φ ∈ ess supp( β ) , where ess supp( β ) is the essential support of the distribution β (that is, Pr φ ∼ β
[ f θ ∗ ( x ) =
f θ ∗ ( c φ ( x ))]
= 1 ).
Assumption 1 says that while we do not know α , we do know another distribution β over corruption functions and that β has support at least as broad as that of α .
Furthermore, any corruption functions sampled from β leave the ground-truth label unchanged.
Otherwise, there would exist a possible set of corruptions with positive ( α -) probability such that changing the ground-truth label here would not change the expected corrupted risk, but would force any classiﬁer to make a mistake with positive probability.
Given Assumption 1, the problem reduces to learning under covariate shift and, since θ ∗ ∈ Θ , empirical risk minimization yields a consistent solution to the original problem (Sugiyama et al., 2007, footnote 3), that is, the risk of (cid:98) θ ( n ) DA converges to the minimum of (4).
Thus, the idealized version of DeepAugment is consistent.
AdversarialAugment.
An idealized version of AdA is deﬁned as
[Equation]
The essential supremum operation represents our ability to solve the difﬁcult computational problem of ﬁnding the worst case corruption (neglecting corruptions of β -measure zero, or in other words, G [Figure] i
[Figure] e [Figure] h o t N o i
[Figure]
e I m pu l s e N o
i s e D e
f
o c u s B
l u r G l a ss B l u r M o t i o n B l u r Z oo m B l u r S n o w
F r o s t
F og
B r
i g h t n e ss C o n t r a s t E l a s t
i c P i x e l a t e J P E G G a u ss i a n B l u r S a t u r a t e S p a tt e [Figure] S p
[Figure] k l e N o
[Figure]
taking supremum over ess supp( β ) L ([ f θ ◦ c φ ]( x i ) , y i ) ).
Assuming that we can compute (5), and the aforementioned essential support of the loss is C ( x i ) , the consistency of AdA (i.e., that the error of (cid:98) θ ( n ) AdA converges to the minimum of (1)) is guaranteed by the fact that θ ∗ ∈ Θ .
Furthermore, as the expected loss of the learned predictor converges to zero for the supremum loss (over the corruptions), so does R ( f (cid:98) θ ( n ) AdA , β ) , and also R ( f (cid:98) θ ( n ) AdA , α ) since ess supp( α ) ⊆
ess supp( β ) [-/β ( W ) for W ⊂ Φ with α ( W ) > 
-](based on
Assumption 1).
Discussion.
In Appendix D we also analyze these algorithms using the PAC-Bayesian view.
For parity with previous works that tackle robustness to image corruptions (like Hendrycks et al., 2020a;
Lee et al., 2020; Rusak et al., 2020)
we constrain capacity and use the ResNet50 architecture for all our models, but note that larger models can achieve better mCE: e.g., Hendrycks et al.
(2020a) train a very large model (R ES N E X T -101 32 × 8 d ; Xie et al., 2016) with AugMix and DeepAugment to obtain 44.5% mCE on I MAGE N ET -C.
In Figure 3 we explore how well Assumption 1 holds in practice, i.e., how well are the corruptions in C IFAR -10-C covered by the corruptions functions used in AdA .
The ﬁgure shows how well the 15 corruptions present in the C IFAR -10-C benchmark can be approximated by two corruption functions: EDSR and CAE .
For each image pair (of a corrupted and clean image) in a random 640-image subset of C IFAR -10-C and C IFAR -10, we optimize the perturbation to the corruption network parameters that best transform the clean image into its corrupted counterpart by solving max δ SSIM ( c φ + δ ( x ) , x (cid:48) )
− 10 − 5 (cid:107) δ (cid:107) 22 , where δ is the perturbation to the corruption network’s parameters, x is the clean example and x (cid:48) is its corrupted counterpart; we also apply (cid:96) 2 regularization with a constant weight (as shown above) to penalize aggressive perturbations.
We use the Adam optimizer (Kingma & Ba, 2014) to take 50 ascent steps, with a learning rate of 0 .
Finally, we average the residual SSIM errors across all ﬁve severities for each corruption type.
Note that both models can approximate most corruptions well, except for Brightness and Snow .
Some corruption types (e.g. Fog , Frost , Snow ) are better approximated by CAE ( 0 .
84 ± 0 .
16 overall SSIM) while most are better approximated by EDSR ( 0 . 91 ± 0 .
26 overall SSIM)
E MPIRICAL R ESULTS
In this section we compare the performance of classiﬁers trained using our method ( AdA ) and competing state-of-the-art methods (AugMix of Hendrycks et al., 2020b, DeepAugment of Hendrycks et al., 2020a) on (1) robustness to common image corruptions (on C IFAR -10-C & I MAGE N ET -C); (2) robustness to (cid:96) p -norm bounded adversarial perturbations; and (3) generalization to distribution shifts on other variants of I MAGE N ET and C IFAR -10. For completeness, on C IFAR -10, we also compare with robust classiﬁers trained using four well-known adversarial training methods from the literature, including: Vanilla Adversarial Training (AT) (Madry et al., 2018), TRADES (Zhang et al., 2019), Adversarial Weight Perturbations (AWP) (Wu et al., 2020) as well Sharpness Aware Minimization (SAM) (Foret et al., 2021).
Additional results are provided in Appendix F.
Overview.
On C IFAR -10-C we set a new state-of-the-art mCE of 7.83% by combining 1 AdA (EDSR) with DeepAugment and AugMix.
On I MAGE N ET (downsampled to 128 × 128 ) we demon- strate that our method can leverage 4 image-to-image models simultaneously to obtain the largest increases in mCE.
Speciﬁcally, by combining AdA (All) with DeepAugment and AugMix we can obtain 62.90% mCE – which improves considerably upon the best model from the literature that we train (70.05% mCE, using nominal training with DeepAugment with AugMix).
On both datasets, models trained with AdA gain non-trivial robustness to (cid:96) p -norm perturbations compared to all other models, while showing slightly better generalization to non-synthetic distribution shifts.
Experimental setup and evaluation.
For C IFAR -10 we train pre-activation ResNet50 (He et al., 2016b) models (as in Wong et al.
on the clean training set of C IFAR -10 (and evaluate on
C IFAR -10-C and C IFAR -10.1)
; our models employ 3 × 3 kernels for the ﬁrst convolutional layer, as in previous work (Hendrycks et al., 2020b).
For I MAGE N ET we train standard ResNet50 classiﬁers on the training set of I MAGE N ET with standard data augmentation but 128 × 128 re-scaled image crops (due to the increased computational requirements of adversarial training) and evaluate on I MAGE N ET - { C,R,v2 } .
We summarize performance on corrupted image datasets using the mean corruption error (mCE) introduced in Hendrycks & Dietterich (2019).
mCE measures top-1 classiﬁer error acrosscorruption types and 5 severities from I MAGE N ET -C and C IFAR -10-C.
For I MAGE N ET only, the top-1 error for each corruption is weighted by the corresponding performance of a speciﬁc AlexNet classiﬁer; see (Hendrycks & Dietterich, 2019).
The mCE is then the mean of the 15 corruption errors.
For measuring robustness to (cid:96) p -norm bounded perturbations, on C IFAR -10 we attack our models with one of the strongest available combinations of attacks: AutoAttack & MultiTargeted as done in
Gowal et al.
(2020); for I MAGE N ET we use a standard 100-step PGD attack with 10 restarts.
Omitted details on the experimental setup and evaluation are provided in Appendix C.
Common corruptions.
On C IFAR -10, models trained with AdA (coupled with AugMix) obtain very good performance against common image corruptions, as shown in Table 1 (left) and Table 8, excelling at Digital and Weather corruptions.
Combining AdA with increasingly more complex methods results in monotonic improvements to mCE; i.e., coupling AdA with AugMix improves mCE from 15.47% to 9.40%; adding DeepAugment further pushes mCE to 7.83%, establishing a new state-of-the-art for C IFAR -10-C. Compared to all adversarially trained baselines, we observe that AdA (EDSR) results in the most robustness to common image corruptions.
Vanilla adversarial training (trained to defend against (cid:96) 2 attacks) also produces classiﬁers which are highly resistant to common image corruptions (mCE of 17 .
On I MAGE N ET , in Table 2 (left) and Table 9 we see the same trend, where combining AdA with increasingly more methods results in similar monotonic improvements to mCE.
The best method combination leverages all 4 image-to-image models jointly ( AdA (All) ), obtaining 62.90% mCE.
This constitutes an improvement of more than 19% mCE over nominal training and 7.15% mCE over the best non- AdA method (DeepAugment + AugMix).
These observations together indicate that the corruptions captured by AdA , by leveraging arbitrary image-to-image models, complement the corruptions generated by both DeepAugment and AugMix.
We observe that neither VQ-VAE nor CAE help improve robustness on C IFAR -10-C while they are both very useful for I MAGE N ET -C.
For example, training with AdA (VQ-VAE) and AdA (CAE) results in 26.77% and 29.15% mCE on C IFAR -10-C respectively, while AdA (All) on I MAGE N ET obtains the best performance.
We suspect this is the case as both VQ-VAE and CAE remove high-frequency information, blurring images (see Figure 1 (c)) which results in severe distortions for the small 32 × 32 images even at very small perturbation
radii (see Figure 2).
Adversarial perturbations.
For C IFAR -10, in the adversarial setting (Table 1, right) models trained with AdA using any backbone architecture perform best across all metrics.
Models trained with AdA gain a limited form of robustness to (cid:96) p -norm perturbations despite not training directly to defend against this type of attack.
Interestingly, combining AdA with AugMix actually results in a drop in robustness across all four (cid:96) p -norm settings for all backbones except U-Net (which increases in robustness).
However, further combining with DeepAugment recovers the drop in most cases and increases robustness even more across the majority of (cid:96) ∞ settings.
Unsurprisingly, the adversarially trained baselines (AT, TRADES & AWP) perform best on (cid:96) 2 - and (cid:96) ∞ -norm bounded perturbations, as they are designed to defend against precisely these types of attacks. AdA (EDSR) obtains stronger robustness to (cid:96) p attacks compared to SAM, while SAM obtains the best generalization to C IFAR -10.1. On I MAGE N ET , as shown in Table 2 (right), the AdA variants that use EDSR obtain the highest robustness to (cid:96) p -norm adversarial perturbations; note that top-1 robust accuracy more than doubles from AdA ( CAE ) to AdA ( EDSR ) across all evaluated (cid:96) p -norm settings.
As for C IFAR -10, combining the best AdA variant with DeepAugment results in the best (cid:96) p robustness performance.
By themselves, neither AugMix nor DeepAugment result in classiﬁers resistant to (cid:96) 2 attacks for either dataset (top-1 robust accuracies are less than 4% across the board), but the classiﬁers have non-trivial resistance to (cid:96) ∞ attacks (albeit, much lower than AdA trained models).
We believe this is because constraining the perturbations (in the (cid:96) 2 -norm) to weights and biases of the early layers of the corruption networks can have a similar effect to training adversarially with input perturbations (i.e., standard (cid:96) p -norm adversarial training).
But note that AdA does not use any input perturbations.
Generalization.
On C IFAR -
(Table 1, center), the models trained with AdA (U-Net) and AdA (EDSR) alone or coupled with AugMix generalize better than the other two backbones to C IFAR -10.1, with the best variant obtaining 90.60% top-1 accuracy.
Surprisingly, coupling AdA with DeepAugment can reduce robustness to the natural distribution shift captured by C IFAR -10.1.
This trend applies to
I MAGE N ET results as well (Table 2, center) when using AdA (All) , as combining it with AugMix,
DeepAugment or both, results in lower accuracy on I MAGE N ET - V 2 than when just using AdA (All) .
These observations uncover an interesting trade-off where the combination of methods that should be used depends on the preference for robustness to image corruptions vs. to natural distribution shifts.
L IMITATIONS
In this section we describe the main limitations of our method: (1) the performance of AdA when used without additional data augmentation methods and (2) its computational complexity.
As can be seen from the empirical results (Tables 1 & 2), AdA performs best when used in conjunction with other data augmentations methods, i.e. with AugMix and DeepAugment.
However, when AdA is used alone, without additional data augmentation methods, it does not result in increased corruption robustness (mCE) compared to either data augmentation method (except for one case, cf.
rows 6 and 7 in Table 2).
AdA also does not achieve better robustness to (cid:96) p -norm bounded perturbations when compared to adversarial training methods.
However, this is expected, as the adversarially trained baselines (AT, TRADES and AWP) are designed to defend against precisely these types of attacks.
Our method is more computationally demanding than counterparts which utilize handcrafted heuristics.
For example, AugMix speciﬁes K image operations, which are applied stochastically at the input (i.e. over images).
DeepAugment requires applying heuristic stochastic operations to the weights and activations of an image-to-image model, so this requires a forward pass through the image-to-image model (which can be computed ofﬂine).
But AdA must optimize over perturbations to the parameters of the image-to-image model; this requires several backpropagation steps and is similar to (cid:96) p -norm adversarial training (Madry et al., 2018) and related works.
We describe in detail the computational and memory requirements of our method and contrast it with seven related works in subsection B.1.
We leave further investigations into increasing the mCE performance of AdA when used alone, and into reducing its computational requirements for future work.
C ONCLUSION
We have shown that our method, AdA , can be used to defend against common image corruptions by training robust models, obtaining a new state-of-the-art mean corruption error on C IFAR
-10-C. Our method leverages arbitrary pre-trained image-to-image models, optimizing over their weights to ﬁnd adversarially corrupted images.
Besides improved robustness to image corruptions, models trained with AdA substantially improve upon previous works’ (DeepAugment & AugMix) performance on (cid:96) 2and (cid:96) ∞
-norm bounded perturbations, while also having slightly improved generalization to natural distribution shifts.
Our theoretical analysis provides sufﬁcient conditions on the corruption-generating process to guarantee consistency of idealized versions of both our method, AdA , and previous work, DeepAugment.
Our analysis also highlights potential advantages of our method compared to DeepAugment, as well as that of the combination of the two methods.
We hope our method will inspire future work into theoretically-supported methods for defending against common and adversarial image corruptions.
[Table]
[Table]
WITHOUT ADDITIONAL DATA AUGMENTATION :
[Table]
WITH A UG M IX :
[Table]
0.06 9 AdA (VQ-VAE) 73.
0.01 10 AdA (EDSR) 73.
0.50 11 AdA (CAE) 80.
[Table]
[Table]
[Table]
[Table]
[Table]
.09 12 AdA
[Table]
All) 72.
[Table]
[Table]
WITH D EEP
A UGMENT : 13 Nominal 73. 0.02 14 AdA [Table] U-Net) 75.
0.10 15 AdA (VQ-VAE) 69.
0.03 16 AdA (EDSR) 65.
1.16 17 AdA (CAE) 77.
0.02 18 AdA (All)
[Table]
WITH A UG M IX & D EEP
A UGMENT : 19 Nominal
[Table]
[Table]
[Table]
[Table]
[Table]
A R ELATIONSHIPS WITH RELATED WORK
Relationship to DeepAugment & AugMix.
AugMix is a data augmentation method which stochastically composes standard image operations which affect color (e.g., posterize, equalize, etc.) and geometry (e.g., shear, rotate, translate)
(Hendrycks et al., 2020b).
Classiﬁers trained with AugMix excel at robustness to image corruptions, and AugMix (when used with a Jensen-Shannon divergence consistency loss) sets the known state-of-the-art on C IFAR -10-C of 10.90%, prior to our result herein.
DeepAugment is a data augmentation technique introduced by Hendrycks et al.
(2020a).
This method creates novel image corruptions by passing each clean image through two speciﬁc pre-deﬁned imageto-image models ( EDSR and CAE ) while distorting the network’s internal parameters as well as intermediate activations.
An extensive range of manually deﬁned heuristic operations (9 for CAE and 17 for EDSR ) are stochastically applied to the internal parameters, including: transposing, negating, zero-ing, scaling and even convolving (with random convolutional ﬁlters) parameters randomly.
Activations are similarly distorted using pre-deﬁned operations; for example, random dimensions are permuted or scaled by random Rademacher or binary matrices.
Despite this complexity, classiﬁers trained with DeepAugment, in combination with AugMix, set the known state-of-the-art mCE on
I MAGE N ET -C of 53.6%.
Any method which relies on image-to-image models (e.g., AdA or DeepAugment) will inherit the limitations of the speciﬁc image-to-image models themselves.
In this paper we focus on local image corruptions, but one might want to train classiﬁers robust to global image transformations – and it is known that most image-to-image models are not well suited for capturing global image transformations (Richardson & Weiss, 2021).
For modeling global image transformations, one could, for example, consider using an image-to-image model consisting of a single spatial transformer layer (Jaderberg et al., 2015).
Applied at the input layer, the spatial transformer differentiably parameterizes a global image transformation.
Leveraging such an image-to-image model would allow
AdA to ﬁnd adversarial examples by optimizing over the global image transformation.
But, using such a model with DeepAugment would ﬁrst require manually deﬁning heuristic weight transformations for this speciﬁc image-to-image model.
Similarly to both AugMix and DeepAugment, AdA is also “speciﬁcation-agnostic”, i.e., all three methods can be used to train classiﬁers to be robust to corruptions which are not known in advance
(e.g., C IFAR -10-C, I MAGE N ET -C).
Both DeepAugment and AdA operate by perturbing the parameters of image-to-image models.
DeepAugment constrains parameter perturbations to follow pre-speciﬁed user-deﬁned directions (i.e., deﬁned heuristically); AdA bounds perturbation magnitudes automatically and prevents severe distortions (by approximately constraining the minimum SSIM deviation of the corrupted examples).
To be able to deﬁne heuristic operations, DeepAugment relies on in-depth knowledge of the internals of the image-to-image models it employs; our method, AdA , does not.
Instead, our method requires a global scalar threshold ν to specify the amount of allowed relative parameter perturbation.
AugMix requires having access to a palette of pre-deﬁned useful input transformations; our method only requires access to a pre-trained autoencoder.
We believe the generic framework proposed in our paper, which (at a minimum) requires an autoencoder and a scalar perturbation radius, is applicable to other domains beyond images.
We leave further investigations to future work.
Relationship to Invariant Risk Minimization.
Invariant Risk Minimization (IRM) proposed by
Arjovsky et al.
(2020) considers the case where there are multiple datasets
D e = { x i , y i } ni =1 drawn from different training environments e ∈ E .
The motivation behind IRM is to minimize the worst-case risk
[Equation]
In our work, the environments are deﬁned by the different corruptions x (cid:48) resulting from adversarially choosing the parameter offsets δ of φ .
Given a dataset { x i , y i } ni =1 , we can rewrite the corrupted adversarial risk shown in (1) as (6) by setting the environment set E to
[Equation]
This effectively creates an ensemble of datasets for all possible values of δ for all examples.
The crucial difference between IRM and AdA is in the formulation of the risk.
In general, we expect AdA to be more risk-averse than IRM, as it considers individual examples to be independent from each other.
Relationship to Adversarial Mixing.
Gowal et al.
(2019) formulate a similar adversarial setup where image perturbations are generated by optimizing a subset of latents corresponding to pre-trained generative models.
In our work, we can consider the parameters of our image-to-image models to be latents and could formulate Adversarial Mixing (AdvMix) in the AdA framework.
Unlike AdvMix, we do not need to rely on a known partitioning of the latents (i.e., disentangled latents), but do need to restrict the feasible set of parameter offsets δ .
Relationship to Perceptual Adversarial Training.
Perceptual Adversarial Training (PAT) (Laidlaw et al., 2021) ﬁnds adversarial examples by optimizing pixel-space perturbations, similar to works on (cid:96) p norm robustness, e.g. (Madry et al., 2018).
The perturbed images are constrained to not exceed a maximum distance from the corresponding original (clean) images measured in the LPIPS metric (Zhang et al., 2018b).
Their setup requires a complex machinery to project perturbed images back to the feasible set of images (within a ﬁxed perceptual distance).
AdA , by construction, uses a well-deﬁned perturbation set and projecting corrupted network’s parameters is a trivial operation.
This is only possible with our method because perturbations are deﬁned on weights and biases rather than on input pixels.
B A LGORITHM DETAILS & COMPUTATIONAL AND SPACE COMPLEXITY
Algorithm 1 contains the algorithm listing for our proposed method.
We illustrate our algorithm using
SGD for clarity.
In practice, we batch training examples together and use the Adam optimizer (Kingma & Ba, 2014) to update the classiﬁer’s parameters θ .
We still compute adversarial examples for each training sample individually using projected FGSM (Goodfellow et al., 2015) steps.
SSIMLineSearch ( x, x (cid:48) )
(cid:46) Approx.
SSIM line-search: App.
E.
[Equation]
(cid:46) Update classiﬁer parameters.
15: Return optimized classiﬁer parameters θ ( N )
B. C OMPUTATIONAL COMPLEXITY AND MEMORY REQUIREMENTS .
Table 3 lists the computational and memory requirements of our method and of related works.
We primarily compare to similar methods which perform iterative optimization to ﬁnd adversarial examples: Vanilla Adversarial Training (AT) (Madry et al., 2018), TRADES (Zhang et al., 2019),
Adversarial Weight Perturbations (AWP) (Wu et al., 2020) and Perceptual Adversarial Training (PAT)
(Laidlaw et al., 2021).
For completeness, we also compare to related methods which do not perform adversarial optimization: Sharpness Aware Minimization (SAM)
Foret et al.
DeepAugment (Hendrycks et al., 2020a) and AugMix (Hendrycks et al., 2020b).
We characterize the number of passes (forward and backward, jointly) through the main classiﬁer network ( f θ ) and, where applicable, through an auxiliary neural network ( c φ ) separately.
For methods using adversarial optimization we also describe the cost of the projection steps used for keeping perturbations within the feasible set.
Taken together, these costs represent the computational complexity of performing one training step with each method.
Note that for our method, the auxiliary network corresponds to the corruption network (i.e. the imageto-image model); for PAT it corresponds to the network used to compute the LPIPS (Zhang et al., 2018b) metric.
We characterize the PAT variant which uses the Lagrangian Perceptual Attack in the externally-bounded case and the default bisection method for projecting images into the LPIPS-ball.
Computational complexity.
For each input example, AdA randomly initializes weight perturbations in O ( | φ | ) time.
It then adversarially optimizes the perturbation using M PGD steps.
These steps amount to M forward and M backward steps through the main classiﬁer ( f θ ) and the corruption network ( c φ ).
At the end of each iteration, the weight perturbation is projected back onto the feasible set by layer-wise re-scaling in O ( | φ | ) time.
After the PGD iterations, an additional forward pass is done through the corruption network, using the optimized perturbation, to augment the input example.
Finally, the SSIM safe-guarding step (see App.
E) takes time proportional to O ( | x | ) .
Similar to AdA , PAT performs multiple forward and backward passes through both the main classiﬁer and an auxiliary network.
PAT searches for a suitable Lagrange multiplier using S steps, and for each candidate multiplier it performs an M -step inner optimization.
This results in (at most) S times more forward and backward passes through the two networks when compared to AdA .
The projection step
[Table]
of PAT
is considerably more expensive, requiring N +1 forward passes through the auxiliary network; however, it is applied only once at the end of the optimization, rather than at every iteration as in AdA .
AT, TRADES and AWP perform M PGD steps, with forward and backward passes done only through the main classiﬁer network – they do not use an auxiliary network.
Hence, these methods have reduced computational complexity compared to PAT and AdA .
DeepAugment augments each data sample by passing it through an auxiliary network while stochastically perturbing the network’s weights and intermediate activations (using a pre-deﬁned set of operations); this amounts to one (albeit modiﬁed) forward pass through the auxiliary network for each input example.
AugMix stochastically samples and composes standard (lightweight) image operations; it does not pass images through any auxiliary network.
AugMix applies at most 3 · K image operations for each input image; K is set to 3 by default (Hendrycks et al., 2020b, Section 3).
Methods which use adversarial training, AT, TRADES, PAT as well as AdA , have higher computational complexity than both DeepAugment or AugMix, as they speciﬁcally require multiple iterations ( M ) of gradient ascent to construct adversarial examples.
Memory requirements.
Compared to AT, TRADES & PAT which operate on input perturbations,
AdA has higher memory requirements as it operates on weight perturbations ( φ ) instead.
Similar to
AT, TRADES and PAT, AdA also operates on each input example independently.
For a mini-batch of inputs, naively, this would require storing the corresponding weight perturbations for each input at the same time in memory.
This could amount to considerable memory consumption, as the storage requirements grow linearly with the batch size and the number of parameters in the corruption network.
Instead, we partition each mini-batch of inputs into multiple smaller “nano-batches”, and ﬁnd adversarial examples one “nano-batch” at a time.
In practice, on each accelerator (GPU or TPU), we use 8 examples per “nano-batch” for C IFAR -10 and 1 for I MAGE N ET .
This allows us to trade-off performance (i.e. parallelization) with memory consumption.
In contrast to AWP, which computes perturbations to the weights of the main classiﬁer ( θ ) at the mini-batch level, AdA computes perturbations to the weights of the corruption network ( φ ) for each input example individually.
DeepAugment samples weight perturbations whose storage grows linearly with the number of parameters in the auxiliary network ( O ( | φ | ) ), matching AdA ’s output storage requirements.
But note that all methods which use adversarial optimization ( AdA included), must also store intermediate activations during each backward pass.
For each input sample AugMix updates an input-sized array using storage proportional to O ( | x | ) , having the same storage requirements as AT or PAT.
Our method must keep the weights of the image-to-image models in memory.
This does not incur a large cost as all models that we use are relatively small: the U-Net model has 58627 parameters (0.23MB); the VQ-VAE model has 762053 parameters (3.05MB); the EDSR model hasparameters (5.48MB) and the CAE model has 2241859 parameters (8.97MB).
C E XPERIMENTAL SETUP DETAILS
Training and evaluation details.
For C IFAR -10 we train pre-activation ResNet50 (He et al., 2016b) models (as in Wong et al.
; as in previous work (Hendrycks et al., 2020b)
our models use 3 × 3 kernels for the ﬁrst convolutional layer.
We use a standard data augmentation consisting of padding by 4 pixels, randomly cropping back to 32 × 32 and randomly ﬂipping left-to-right.
We train all robust classiﬁers ourselves using the same training strategy and architecture as for our own method (as described above); we use a perturbation radius of 0 .
5 for (cid:96) 2 robust training and of 8 / 255 for (cid:96) ∞ robust training.
For both (cid:96) 2 and (cid:96) ∞ robust training, we sweep over AWP step sizes of 0 .
001 , 0 . 0005 and 0 . 0001 ; we further evaluate the two models which obtained the best robust train accuracy (for (cid:96) 2 this is the model which uses an AWP step size of 0 . 001 , and for (cid:96) ∞ it is the model which uses one of 0 . 0005 ).
Similarly, for SAM we train ﬁve models sweeping over the step size ( 0 . 2 , 0 . 15 , 0 . 1 , 0 .
and further evaluate the one obtaining the best robust train accuracy (which uses a step size of 0 . 05 ). For I MAGE N ET we use a standard ResNet50 architecture for parity with previous works.
We use a standard data augmentation, consisting of random left-to-right ﬂips and random crops.
Due to the increased computational requirements of training models with AdA (due to the adversarial training formulation) we resize each random crop (of size 224 × 224 ) to 128 × 128 using bilinear interpolation.
We perform standard evaluation by using the central image crop resized to 224 × 224 on I MAGE N ET , even though we train models on 128 × 128 crops.
All methods are implemented in the same codebase and use the same training strategy (in terms of standard data augmentation, learning rate schedule, optimizers, etc.).
Outer minimization.
We minimize the corrupted adversarial risk by optimizing the classiﬁer’s parameters using stochastic gradient descent with Nesterov momentum (Polyak, 1964; Nesterov, 1983).
For C IFAR -10 we train for 300 epochs with a batch size of 1024 and use a global weight decay of 10 − 4 .
For I MAGE N ET we train for 90 epochs with a batch size of 4096 and use a global weight decay of 5 · 10 − 4 .
We use a cosine learning rate schedule (Loshchilov & Hutter, 2017), without restarts, with 5 warm-up epochs, with an initial learning rate of 0 . 1 which is decayed to 0 at the end of training.
We scale all learning rates using the linear scaling rule of Goyal et al.
(2017), i.e., effective LR = max( LR × batch size / 256 , LR ) .
In Algorithm 1 the effective learning rate of the outer optimization is denoted by η f .
Inner maximization.
Corrupted adversarial examples are obtained by maximizing the crossentropy between the classiﬁer’s predictions on the corrupted inputs (by passing them through the corruption network) and their labels.
We initialize the perturbations to the corruption network parameters randomly within the feasible region.
We optimize the perturbations using iterated fastgradient sign method (FGSM) steps (Goodfellow et al., 2015; Kurakin et al., 2016) 2 .
We project the optimization iterates to stay within the feasible region.
We use a step size equal to 1 / 4 of the median perturbation radius over all parameter blocks (for each backbone network individually).
In
Algorithm 1 this step size is denoted by η c .
For C IFAR -10 we use 10 steps; for I MAGE N ET we use only 3 steps (due to the increased computational requirements) but we increase the step size by a factor of 10 / 3 to compensate for the reduction in steps.
When AdA is speciﬁed to use multiple backbones simultaneously (e.g., “ AdA (All) ” which uses four image-to-image models) each backbone is used for ﬁnding adversarial examples for an equal proportion of examples in each batch.
Combining data augmentation methods.
We view the process of combining data augmentation methods as a data pipeline, where the output from each stage is fed as input to the next stage.
We ﬁrst draw random samples either from the clean training dataset or from the DeepAugment-processed training set if DeepAugment is used, as in Hendrycks et al.
(2020a).
Then we apply standard data augmentation (random pad and crop for C IFAR -10, random left-right ﬂip and resized crop for
I MAGE N ET ).
When AdA is used, we apply it now in the pipeline, followed by the SSIM line-search procedure.
When AugMix is used, we apply it as the ﬁnal step in the data pipeline.
Corruption networks.
We train a separate VQ-VAE and U-Net model on the training set of each of
C IFAR -
and I MAGE N ET (for a total of four models).
We train VQ-VAE models using the standard
VQ-VAE loss (van den Oord et al., 2017, Eq. 3) with 128 (base) convolutional ﬁlters, a 2 -layer residual stack (with 32 convolutional ﬁlters)
; we use a vector quantisation embedding dimension of 512 , a commitment cost of 0 .
and use exponential moving averages to update the embedding vectors.
We train U-Net models on an image completion task; i.e. we zero-out 2 - 35% random pixels of each input image and train the U-Net to ﬁll-in the deleted pixels.
We use an image reconstruction loss which is the sum of the mean absolute pixel differences and the mean squared pixel differences (with the latter being scaled by 0 .
The U-Net architecture we use has a two-layer encoder (withand 32 ﬁlters respectively) and a three-layer decoder (with 64 , 32 and 16 ﬁlters respectively).
We train all four image-to-image models for 90 epochs, with a batch size of 1024 for I MAGE N ET and of 16384 for C IFAR -10.
We use the Adam optimizer (Kingma & Ba, 2014) with an initial learning rate of 0 .
0003 for I MAGE N ET and 0 .
003 for C IFAR -10, which we decay throughout training using the linear scaling rule of Goyal et al.
For both EDSR and CAE we use the same model architectures and pre-trained weights as the ones used by DeepAugment (which are available online).
D PAC-B AYESIAN ANALYSIS .
We can also reason about the idealized AdA and DeepAugment algorithms (from Section 4 in the main manuscript) using the PAC-Bayesian view. If random perturbations (cid:15) are introduced to the parameter θ of the classiﬁer f θ , the following bound holds (see, e.g., Neyshabur et al., 2017):
3 Given a prior distribution P over Θ , which is independent of the training data, for any η ∈ (0 , 1) , with probability at least 1 − η , [Equation] where (cid:98) R ( f θ ) = 1 n (cid:80) ni =1 L ([ f θ ◦ c φ ]( x i ) , y i ) and KL( θ + (cid:15) (cid:107) P ) is the KL divergence between the parameter distribution θ + (cid:15) (given θ ) and P .
4 Deﬁning P and (cid:15) to have spherically invariant normal distributions with variance σ 2 in every direction, the KL term becomes (cid:107) θ (cid:107) 22 2 σ 2 , and so the second term goes to zero as the number of samples increases (and θ does not grow fast). An idealistic choice (recommended, e.g., by Neyshabur et al., 2017) is to choose the perturbation of each parameter to be proportional to the parameter value itself, by setting the standard deviation of (cid:15) j (the j th coordinate of (cid:15) ) and the corresponding coordinate of P as σ j = σ | θ j | + b , making the KL term equal to (cid:80) j θ 2 j 2 σ 2 j .
Note, however, that since f θ depends on the training data, this choice makes the bound in (8) invalid, hence, in our experiment we choose (cid:15) i to be proportional to the average norm of the weights in each layer when trained on a different (but similar) dataset.
Note that minimizing the ﬁrst term on the right hand side of (8) is not straightforward during training, since we have no access to corruptions sampled from α .
DeepAugment tries to remedy this situation by using samples from β ; however, the effectiveness of this depends on how well β approximates α , more directly on the importance sampling ratios α ( W ) /β
{+( W ) for W ⊂ Φ with α ( W ) > 
+}
(see Assumption 1).
On the other hand,
AdA minimizes the worst-case loss over ess supp( β ) , which dominates the worst-case loss over ess supp( α ) under Assumption 1, which minimizes the expected loss over α , which is the ﬁrst term.
Thus, AdA minimizes an upper bound on the ﬁrst term, while DeepAugment only minimizes a proxy.
We have assumed that θ ∗ ∈ Θ implying that the classiﬁer is over-parameterized.
This is a common assumption in the literature which often holds in practice (Zhang et al., 2016).
Performance under stochastic parameter perturbations In Table 4, we show that the performance of an AdA -trained classiﬁer gradually degrades under increasingly larger perturbations to its parameters, providing experimental support for the PAC-Bayes analysis.
Let w denote a block of parameters (e.g., the set of convolutional ﬁlters of a layer) and w j be the j -th coordinate of the parameter block; then, (cid:15) j is the stochastic perturbation we add to the individual scalar parameter w j .
We draw the perturbation (cid:15) j from a 0 -mean Gaussian with standard deviation proportional to the (cid:96) ∞ norm (i.e., the maximum absolute value) of the enclosing parameter block: (cid:15) j ∼ N (0 , η (cid:107) w (cid:107) ∞ ) , where η denotes the standard deviation scaling factor.
We vary η from 0 .(0% noise; i.e., nominally evaluated model) to 0 .
10 (10% noise) in increments of 0 .
02 (2% noise at a time), as shown in the ﬁrst column of Table 4.
We sample stochastic parameter perturbations (for all of f θ ’s parameters) 50 times per dataset example and average the model’s predicted probabilities (i.e., we average the softmax predictions and then compare the averaged prediction with the ground-truth label).
The table shows top-1 clean error, mCE and individual corruption error (averaged over all severities) for increasingly larger stochastic parameter perturbations to the AdA + A UG M IX classiﬁer trained on
C IFAR -10.
[Table]
We observe a gradual degradation in mCE and clean error when increasing the expected magnitude of parameter perturbations.
Performance on mCE is maintained up to and including a noise level of 2%, and on clean error up to a noise level of 4% respectively.
E A PPROXIMATE SSIM LINE - SEARCH PROCEDURE
The adversarial examples produced by AdA can sometimes become too severely corrupted (i.e., left-tail of densities in Figure 2 of the main manuscript).
We guard against these unlikely events by using an efﬁcient, approximate line-search procedure.
We set a maximum threshold, denoted by t , on the SSIM distance between the clean example and the AdA adversarial example.
Denote by x γ the linear combination of the clean example, x , and the corrupted example output by
AdA , ˆ x :
[Equation]
When the deviation in SSIM between the clean and the corrupted example is greater than the threshold (SSIM ( x, ˆ x ) > t ), we ﬁnd a scalar γ ∗ ∈ [0 , 1] such that the deviation between the corrected example, x ∗ γ , and the clean example, x , is t : SSIM ( x, x ∗ γ ) =
t .
We take 9 equally-spaced γ values in [0 , 1] and evaluate the SSIM distance between the clean example and x γ for each considered γ .
We ﬁt a quadratic polynomial in γ to all the pairs of γ and the threshold-shifted SSIM deviation from the clean example SSIM ( x, x γ ) − t .
We then ﬁnd the roots of this polynominal, clip them to [0 , 1] , and take the γ closest to 1 as the desired γ ∗ .
This corresponds to returning the most corrupted variant of x along the ray between x and ˆ x which obeys the SSIM threshold.
The procedure is very efﬁcient on accelerators (GPUs, TPUs) as it requires no iteration.
It is approximate, however, because the quadratic polynomial can underﬁt.
In practice, we use a maximum SSIM threshold ( t ) of 0 .
3 for C IFAR -10 experiments and one of 0 .for
I MAGE N ET experiments.
Computing the SSIM distance.
For computing the SSIM distance we follow the original paper (Wang et al., 2004) and use an isotropic Gaussian weighting function of 11 × 11 with a 1 .standard deviation (normalized), and regularization parameters K 1 = 0 .
01 , K 2 = 0 .
F A DDITIONAL EXPERIMENTS AND COMPARISONS
Comparison to previous work on C IFAR -10.
Perceptual Adversarial Training (PAT) (Laidlaw et al., 2021) proposes an adversarial training method based on bounding a neural perceptual distance (LPIPS).
Appendix G (Table 10) of the PAT article shows the performance of various models on common image corruptions.
However, performance is summarized using relative mCE, whereas we use absolute mCE throughout.
The authors kindly provided us 6 with the raw corruption errors of their models at each severity and we reproduce their results in (the top half of) Table 5.
We observe that PAT has overall lower robustness to common image corruptions (best variant obtains 23.54% mCE) than AugMix (10.90% mCE) and than our best AdA -trained model (7.83% mCE).
PAT however, performs very well against other adversarial attacks 7 , including (cid:96) p -norm bounded perturbations.
The best PAT model obtains 28.7% robust accuracy against (cid:96) ∞ attacks ( (cid:15) = 8 / 255 ) and 33.3% on (cid:96) 2 attacks ( (cid:15)
= 1 ) while our best AdA -variant obtains less robust accuracy in each case (0.99% against (cid:96) 2 attacks and 13.88% against (cid:96) ∞ attacks with (cid:15)
= 4 / 255 ).
This difference in performance against (cid:96) p -norm attacks is not surprising, as PAT addresses robustness to pixel-level attacks (i.e., it manipulates image pixels directly); whereas AdA applies adversarial perturbations to the corruption function parameters (and not to the image pixels directly).
In similar spirit to PAT, Kireev et al.
(2021) introduce an efﬁcient relaxation of adversarial training with LPIPS as the distance metric.
Their best model, with a smaller architecture, R ES N ET 18, obtains 11.47% mCE on C IFAR -10-C.
The authors of Kireev et al.
(2021) also show that models trained adversarially against (cid:96) p -norm
bounded perturbations can act as a strong baseline for robustness to common image corruptions.
The strongest known 8 adversarially trained model against (cid:96) p -norm bounded perturbations on common image corruptions is that of Gowal et al.
(2020) which obtains 12.32% mCE (training against (cid:96) 2 -norm
bounded perturbations with (cid:15)
= 0 .
5 while using extra-data).
In Wong & Kolter (2021a), the authors ﬁrst train generative models to represent image corruptions by feeding them a subset of the common image corruptions (from C IFAR -10-C).
In a second stage, they train classiﬁers using samples (adversarial or random) coming from these pre-trained generative models.
Despite having this additional knowledge of the test set corruptions, the robust classiﬁers they train only achieve between 9.5% and 9.7 mCE%.
To the best of our knowledge, our best performing model ( AdA (EDSR) coupled with AugMix and
DeepAugment) is more robust to common image corruptions on C IFAR -10 than all previous methods, obtaining a new state-of-the-art mCE of 7.83%.
Number of inner optimization steps.
We show the effect of changing the number of inner optimization steps (i.e. the number of PGD steps for ﬁnding adversarial examples) for AdA (EDSR) on C IFAR -10 in Table 6.
We sweep a number of PGD steps from 0 to 10 where 10 is the default
[Table]
for C IFAR -10.
As described in section C, we compensate for the decrease in number of PGD steps (from 10 ) by proportionally scaling up the step size (i.e. effective η c =
[Table]
Zero ( 0 ) PGD steps correspond to only performing the random initialization of perturbations to the corruption network’s parameters (i.e. lines 5-6 in Algorithm 1).
We observe that performance on common image corruptions in aggregate (mCE) and for individual groups, in general, increases with the number of inner optimization PGD steps.
We note that adversarial training appears to be necessary for training the most robust models, and randomly sampling the parameter perturbations is not sufﬁcient.
[Table]
G AU SS
S HO T
I M P
U L S E
D E F O C U S
G L A SS
M O T I ON
Z OO M
S NO W
F R O S T
F OG
[Table]
R I GH T
C ON T R A S T
E L A S T I C
P
I X EL
J P E
[Table]
Perturbation radius.
We show the effect of changing the corruption network parameters perturbation radius in AdA on C IFAR -10 in Table 7.
We perform a sweep on the perturbation radius by scaling the radius ( ν = 0 . 015 ) of the best performing model, AdA (EDSR)
+ DeepAugment + AugMix (from Table 1 in the main manuscript), by { 0.5, 0.75, 1.0, 1.25, 1.5 } .
We observe that the robustness performance varies minimally across a small range of perturbation radii.
Performance on image corruptions through training.
We visualize the performance of AdA trained models (best AdA -combination from Table 1 and Table 2 from the main manuscript) during training in Figure 4.
Due to adversarial training, we expect the performance on each of the *-C corruptions to improve as training progresses, and this is indeed what we observe.
On both datasets, the AdA -trained classiﬁers perform consistently best on Brightness , especially at the beginning of training.
On I MAGE N ET performance increases more slowly on the Blur -type corruptions than on all others.
Extended results on individual image corruptions.
We provide supplemental details to Tablesand 2 (from the main manuscript) on individual corruption types in Table 8 and Table 9, respectively.
[Table]
[Table]
[Table]
WITH A UG M IX & D EEP A UGMENT :
[Table] [Table] [Figure] [Table]