Randomly projecting out distribution shifts for improved robustness
Abstract
Real-world applications of machine learning require a model to be capable of dealing with domain shifts that might occur at test time due to natural perturbations to the data distribution induced by, for example, changes in the data collection conditions, or synthetic distortions such as adversarial attacks.
While a learning system might be simultaneously vulnerable to natural and hand-engineered perturbations, previous work has mainly focused on developing techniques to alleviate the effects of speciﬁc types of distribution shifts.
In this work, we propose a uniﬁed and versatile approach to mitigate both natural and artiﬁcial domain shifts via the use of random projections.
We show that such projections, implemented as convolutional layers with random weights placed at the input of a model, are capable of increasing the overlap between the different distributions that may appear at training/testing time.
We evaluate the proposed approach on settings where different types of distribution shifts occur, and show it provides gains in terms of improved out-of-distribution generalization in the domain generalization setting, as well as increased robustness to two types of adversarial perturbations on the
CIFAR-10 dataset without requiring adversarial training.
Introduction
Different forms of distribution shifts often affect model’s prediction performance in machine learning applications.
In recent years, new techniques have emerged to allow learning under naturallyoccurring data variations, in settings such as domain adaptation and domain generalization [1, 2, 3, 4, 5].
Simultaneously, the vulnerability of neural networks to hand-crafted perturbations has also drawn attention due to the threat it poses to safety-critical applications.
Thus, a myriad of techniques tailored to improve the robustness against artiﬁcially generated out-of-distribution examples has been proposed [6].
Although previous work has proposed to leverage advances in domain adaptation approaches to improve adversarial robustness [7, 8] and to mitigate the effect of distribution shifts by performing some type of adversarial training [9, 10], only few contributions [11] attempted to devise strategies capable of dealing with both types of distribution shifts.
In this work, we propose an efﬁcient and uniﬁed framework to deal with both natural and artiﬁcial domain changes: Randomly Projecting Out Distribution Shifts (RPODS).
Motivated by the earlier success of random projections for applications such as generative modeling [12, 13], data augmentation [14, 15], among others [16, 17, 18], we employ random data transformations as a means for distribution matching. RPODS leverage an earlier result for random matrices [12] that shows that the overlap between the support of two distributions in a randomly projected space is likely to increase. We then hypothesize that such random projections might contribute to decrease the amount of available domain-speciﬁc information, facilitating applications of neural networks where robustness to distribution shifts is required. We empirically verify this claim by showing that mapping input samples to such spaces via random convolutions decreases a notion of divergence between pairs of domains.
As further practical contributions, the proposed approach does not rely on domain labels as several domain generalization approaches [2], as well as further increases the robustness of a model to white-box adversarial attacks.
That is, random projection layers are re-sampled prior to every prediction.
As such, a subset of the model’s parameters is always unknown to the attacker.
Doing so limits the action of attacks that rely on previous knowledge about the model, while not harming the original accuracy, unlike methods that include adversarial examples at training time.
Our contributions are summarized in the following:
We propose RPODS, a principled, uniﬁed, and versatile approach to improve neural networks robustness to natural and artiﬁcial distribution shifts via random projections; 2.
We empirically conﬁrm that random projections ﬁlter away domain-speciﬁc information by estimating a notion of divergence between pairs of domains represented in the original and projected spaces; 3.
We challenge the versatility of RPODS by performing experiments in two settings where distributions shifts are present, namely domain generalization and adversarial robustness, and show that RPODS outperform approaches tailored to tackle either one of the settings.
Using random projections to mitigate distribution shifts
In this section, we motivate the use of random projections to handle distribution shifts, and introduce the proposed approach that leverages such result on neural networks.
Let the input space be represented by X ⊂ R d , while Y denotes the label space.
In this case, examples correspond to pairs ( x, y ) : x ∈ X , y ∈ Y .
Let D denote a distribution over X × Y and be referred to a as domain .
We consider settings where a predictor h : X → Y must present a good generalization performance (in terms of expected risk) on different domains, including those not available at training time.
In particular, we tackle the domain generalization setting [19, 20].
We are concerned with cases where a set with N domains is available, and their marginal distributions
D i ( x ) , i ∈ { 1 , ..., N } , differ, while data-conditional label distributions D ( y | x ) remain unchanged (i.e. the standard covariate shift scenario [2, 21, 22]) 1 .
Consider the input space X is the d-dimensional ball B d of radius 1 centered at 0 and deﬁne the support of a domain D , supp ( D ) ⊂ B d , as the set where the corresponding density is greater than some small threshold.
The following result shows that the support of a projected domain occupies a higher fraction of the projected input space volume.
Theorem 1.
(Neyshabur et al.
Assume D ( x ) = (cid:80) j τ j N ( x | µ j , Σ j ) is a mixture of Gaussians, such that there is no overlap between the supports or the projections of the components.
If supp ( D ) ⊂
B d and Vol ( supp ( D )) > 0 , then, with high probability:
[Equation]
where D W represents the marginal of D along a random projection W and X W denotes the projection of the input space.
Theorem 1 shows that random projections increase the overlap between the supports of distributions over the input space and thus can reduce covariate shifts.
More speciﬁcally, in case two domains over X , D 1 and D 2 , are considered, the projection W acts in such a way that it likely increases the overlap between both domains.
In the next section, we empirically conﬁrm this observation by showing that the A -distance [23], a proxy for the H -divergence [24], that accounts for mismatches between distributions over the input space, is indeed decreased when estimated over projected inputs, i.e., d A ( D 1 , D 2 ) >
d A ( D 1 W , D 2 W ) .
2.1 Random projections as convolutional layers
In practice, we consider applications of neural networks and implement our approach to Randomly Project Out Distribution Shifts (RPODS) using convolutional layers.
More speciﬁcally, we consider a bank of K projections such that X W ⊂ R m and each random projection matrix W k ∈ R d × m , k = { 1 , . .
, K } , has entries drawn from a Gaussian distribution.
In all of our experiments, we considered N (0 , σ 2 ) , where σ is set as per the scheme introduced in [25].
In order to prevent the resulting projections to be drastically distorted, we project the parameters of the random convolutional layers to the L2 unitary ball.
A model is then trained considering examples in a projected input space X W induced by projections matrices that are re-sampled at every iteration.
Figure 1 illustrates the use of RPODS and shows examples from the PACS [26] dataset in a projected space.
2.2 Re-initializing the projections for improved robustness to white-box attacks
We further highlight that RPODS induce a further beneﬁt in terms of improving a models’ robustness to attacks that rely on knowledge about the model parameters (i.e. the white-box access model).
By re-sampling the projection matrices at every iteration, in addition to having an input where distribution shifts are reduced, a part of the model parameters is constantly changing and, therefore, the attacker will never have access to the complete model when generating adversaries. Larger discrepancy [Figure] discrepancy
[Figure]
2.3 Related work
Xu et al.
[15] proposed a data augmentation based on multi-scale random convolutions for tasks under the domain generalization setting where a single domain is available at training time.
The introduced RandConv consists in augmenting the training data with the output of convolutional layers which are randomly initialized and not updated during training. Best results were found by mixing the original input with the output of the random convolutions. The use of such approach to generate augmentations is motivated by the intuition that augmented images will present diverse types of texture. Previous work has also shown that techniques based on random convolutions can also be promising for improving robustness to adversarial perturbations via a data augmentation scheme [14].
Similarly to RandConv, in [14], a set of ﬁxed random convolutions is computed ofﬂine, prior to training, and used to augment the original training set.
Notice that the aforementioned are fundamentally different from our proposed approach in both motivation and implementation.
While in [15] the use of random projections is intuitively motivated, we propose a principled approach by taking into account theoretical results that prove why the use of random projections is helpful for improving out-of-distribution generalization.
Moreover, the implementation of our approach greatly differs from [14] and [15] mostly due to the following aspects: the original examples are not taken into account during training, and convolutional layers are re-sampled at every iteration in order to provide improve robustness to white-box adversarial attacks.
In this section, we empirically show that, as stated by Theorem 1, the use of RPODS in fact helps to reduce distribution shifts, and evaluate the capability of RPODS to improve robustness to artiﬁcial and natural shifts in practical scenarios.
In the case of natural domain shifts, we consider the domain generalization setting under a leave-one-domain-out scheme.
We thus train a model with RPODS via empirical risk minimization with examples drawn from training distributions while evaluating it on an unseen domain.
Finally, we show that RPODS are also able to improve robustness to adversarial attacks.
For that, we use the CIFAR-10 dataset and evaluate on common adversarial perturbations.
In all cases, we compare RPODS with methods tailored to deal with either natural or artiﬁcial shifts.
3.1 Random projections decrease domain divergences
We consider the PACS dataset and a ResNet-18 [27] as backbone architecture.
To evaluate whether randomly projecting distributions can in fact help to reduce distribution shifts, we estimate the
A -distance for each pair of domains within the PACS dataset, and compare the values obtained with raw inputs versus projected inputs using RPODS.
To do so, we train a ResNet-18 to predict domain labels, and use the error rate on the test set to estimate the distances (refer to the Appendix A.2 for experimental details).
Figures 2 and 3 show the A -distance values for all pairs of domains for a model with and without RPODS, respectively.
Each entry in the matrix depicted in the ﬁgure represents a value of distance computed considering a pair of domains, which are indicated by their initials (i.e. the “Sketch” domain is denoted by “S”).
Further visualizations for this experiment can be found in Appendix A.1.1.
We remark that, for all pairs of domains within the PACS dataset, the use of RPODS consistently decreases divergences between domains in comparison to raw data.
As anticipated in Theorem 1, this result provides further evidence that random transformations yield a decrease in domain discrepancies.
Therefore, RPODS are suitable for domain generalization/adaptation settings, since previous work [24, 21, 2] showed that encodings resulting in smaller A -distance between domains favour out-ofdistribution generalization.
Based on the examples of projected inputs provided in Figure 1, we argue that RPODS act by removing domain-speciﬁc information such as texture, and thus enforces a model to focus on higher-level features such as shape, which are more uniform across different domains.
3.2 Domain generalization
To evaluate RPODS on the domain generalization setting, we once more consider the PACS dataset and a ResNet-18 architecture.
Results in Figures 2 and 3 show that RPODS reduce mismatches between data marginal distributions.
Now, we are interested in verifying whether the projected input space preserves enough task-related information so that a model trained with RPODS is still capable of predicting class labels.
For that, we compare the out-of-domain accuracy achieved by a model with RPODS to several approaches tailored to the domain generalization setting, as well as a model trained via standard empirical risk minimization.
Following recent work [28], we consider a ResNettrained from scratch in order to favour a fair comparison with previous approaches, i.e. the impact of pre-training on ﬁnal performances is ruled out.
In Table 1, we report the out-of-domain performances of models trained with RPODS on the source domains (e.g., results under column “Photo” correspond to models trained on “Art”+“Cartoon”+“Sketch”).
We report the average performance across three independent training runs of the model when it presented its best in-domain accuracy (c.f. model selection protocol called training domain validation set in [29]).
Baselines correspond to standard classiﬁers (denoted
ERM) as well as recent methods speciﬁcally designed to tackle the domain generalization setting: self-challenge (SC) [30], Group DRO [31], GNN-Tag [32], and MLDG [33].
Further experimental details and results, including conﬁdence intervals and other model selection criteria are presented in
Appendix A.1.2.
Results show that RPODS exceed the performance of the majority of the considered baselines in all domains and present the highest average accuracy on PACS, showing that performing
ERM on top of random projected input spaces improves out-of-distribution generalization.
[Table]
[Table]
3.3 Adversarial robustness
Lastly [Table] we evaluate the performance of RPODS against white-box adversarial perturbations.
For that, we train a wide-ResNet [34] with RPODS on the CIFAR-10 dataset for 600 epochs [Table] and report the robust accuracy of the model with best validation performance.
We consider FGSM [35] and PGD [34] attacks under L ∞ budgets.
Importantly, we compare RPODS performance with approaches that have access to adversarial examples at training time , namely: adversarial training (AT) [34], adversarial logit pairing (ALP) [36], triplet loss adversarial training (TLA) [37], and TRADES [38].
Results in Table 2 show that RPODS achieve better accuracy on clean samples than most of the baselines and competitive robust accuracy for both attacks.
Moreover, when compared with the undefended model (ERM), we observe that RPODS greatly improve the robust accuracy despite the fact that no adversarial training is performed in this case.
Conclusions
We introduced RPODS – a simple and efﬁcient approach to mitigate the effects of distribution shifts on neural networks performance.
In practice, RPODS project the input space via a bank of random projections, implemented as a convolutional layer added to the input of a model, with weights re-sampled at every iteration.
We show that RPODS improve out-of-distribution generalization in scenarios where distribution shifts stem from different sources.
More speciﬁcally, experiments on the PACS dataset showed that RPODS improve upon a number of approaches tailored to the domain generalization setting, improving the average accuracy on unseen domains by almost 6.8 % with respect to the best performing baseline.
We also evaluated RPODS in a setting where domain shifts were given by adversarial perturbations and showed that, despite its simplicity, RPODS greatly improved robustness to white-box attacks on the CIFAR-10 dataset in comparison to the undefended model.
Notably, models employing RPODS are competitive when compared to adversarial training approaches, speciﬁcally designed to attenuate the effects of adversarial perturbations.
Future work includes exploring the use of RPODS in situations where robustness to natural and adversarial distribution shifts is simultaneously required, as well as other out-of-distribution generalization settings such as single-source domain generalization and domain adaptation.
A Appendix A.1 Extra results
A.1. 1 Divergence estimation
In order to further highlight that the use of RPODS help to decrease domain divergences, we plot in
Figure 4 the values of the A -distance obtained by a training a model on the original input space versus the A -distance values achieved by a model trained on top of the projected space (i.e. with RPODS) for each pair of domain. Each value is indicated by an “x”, and markers lying below the dashed line indicate the cases where the A -distance was higher for the model trained on the original input space. Notice that all points lie below the diagonal, indicating that, for all studied cases, RPODS were able to reduce domain shift.
A.1.2 Domain Generalization
We provide additional results for the experiments under the domain generalization setting in Table
[Table] In addition to the results presented in Table [Table] we include JiGen [39] and Episodic-DG [40] in the comparison and present the standard deviation of accuracy values obtained by RPODS across three run.
Additionally, we report the performance of RPODS considering the “Oracle” selection criterion as introduced by [29].
In this case, the best performance selected by computing the accuracy on a partition of the data corresponding to the unseen domain.
[Table]
A.2 Experimental details
A -distance estimation.
In order to estimate the A -distance, we consider a hypothesis class corresponding to all models parameterized by a ResNet-18.
We train both models with SGD with a learning set to equal to 0.001 and weight decay parameter equal to 0.00001.
We report the accuracy on the validation partition of each domain after 10 training epochs.
Domain generalization.
We implemented RPODS and run the experiments on the domain generalization setting using [29] with the following hyperparameters:
• Batch size:• Iterations:
• Learning rate: 5e- • Number of random projections:• Random projection kernel size:• Random projection stride:•
Weight decay: 0.
• Dropout: 0.
Adversarial robustness.
We trained a ResNet with SGD using the hyperparameters reported below.
Attacks were implemented using FoolBox 2 .
• Batch size:• Epochs:•
Initial learning rate: 0. • Schedule: Decay the learning by a factor of 10 at epochs [10 , 150 , 250 , 350] .
• Number of random projections:• Random projection kernel size:• Random projection stride:•
Weight decay: 0.
• Dropout probability: 0.