N OISY F EATURE M IXUP
hoe
A BSTRACT
We introduce Noisy Feature Mixup (NFM), an inexpensive yet effective method for data augmentation that combines the best of interpolation based training and noise injection schemes.
Rather than training with convex combinations of pairs of examples and their labels, we use noise-perturbed convex combinations of pairs of data points in both input and feature space.
This method includes mixup and manifold mixup as special cases, but it has additional advantages, including better smoothing of decision boundaries and enabling improved model robustness.
We provide theory to understand this as well as the implicit regularization effects of
NFM.
Our theory is supported by empirical results, demonstrating the advantage of NFM, as compared to mixup and manifold mixup.
We show that residual networks and vision transformers trained with NFM have favorable trade-offs between predictive accuracy on clean data and robustness with respect to various types of data perturbation across a range of computer vision benchmark datasets.
I NTRODUCTION
Mitigating over-ﬁtting and improving generalization on test data are central goals in machine learning.
One approach to accomplish this is regularization, which can be either data-agnostic or data-dependent (e.g., explicitly requiring the use of domain knowledge or data).
Noise injection is a typical example of data-agnostic regularization (Bishop, 1995), where noise can be injected into the input data (An, 1996), or the activation functions (Gulcehre et al., 2016), or the hidden layers of deep neural networks (Camuto et al., 2020; Lim et al., 2021).
Data augmentation constitutes a different class of regularization methods (Baird, 1992; Chapelle et al., 2001; DeCoste & Sch ¨ olkopf, 2002), which can also be either data-agnostic or data-dependent.
Data augmentation involves training a model with not just the original data, but also with additional data that is properly transformed, and it has led to state-of-the-art results in image recognition (Cires¸an et al., 2010; Krizhevsky et al., 2012).
The recently-proposed data-agnostic method, mixup (Zhang et al., 2017), trains a model on linear interpolations of a random pair of examples and their corresponding labels, thereby encouraging the model to behave linearly in-between training examples.
Both noise injection and mixup have been shown to impose smoothness and increase model robustness to data perturbations (Zhang et al., 2020; Carratino et al., 2020;
Lim et al., 2021), which is critical for many safety and sensitive applications (Goodfellow et al., 2018; Madry et al., 2017).
In this paper, we propose and study a simple yet effective data augmentation method, which we call
Noisy Feature Mixup (NFM).
This method combines mixup and noise injection, thereby inheriting the beneﬁts of both methods, and it can be seen as a generalization of input mixup (Zhang et al., 2017) and manifold mixup (Verma et al., 2019).
When compared to noise injection and mixup, NFM imposes regularization on the largest natural region surrounding the dataset (see Fig. 1), which may help improve robustness and generalization when predicting on out of distribution data.
Conveniently,
NFM can be implemented on top of manifold mixup, introducing minimal computation overhead. [Figure]
Contributions.
Our main contributions are as follows.
• We study NFM via the lens of implicit regularization, showing that NFM ampliﬁes the regularizing effects of manifold mixup and noise injection, implicitly reducing the feature-output Jacobians and Hessians according to the mixing level and noise levels (see Theorem 1).
• We provide mathematical analysis to show that NFM can improve model robustness when compared to manifold mixup and noise injection.
In particular, we show that, under appropriate assumptions, NFM training approximately minimizes an upper bound on the sum of an adversarial loss and feature-dependent regularizers (see Theorem 2).
• We provide empirical results in support of our theoretical ﬁndings, showing that NFM improves robustness with respect to various forms of data perturbation across a wide range of state-of-theart architectures on computer vision benchmark tasks.
In the Supplementary Materials ( SM ), we provide proofs for our theorems along with additional theoretical and empirical results to gain more insights into NFM.
In particular, we show that NFM can implicitly increase classiﬁcation margin (see Proposition 1 in SM C) and the noise injection procedure in NFM can robustify manifold mixup in a probabilistic sense (see Theorem 5 in SM D).
We also provide and discuss generalization bounds for NFM (see Theorem 6 and 7 in SM E).
Notation.
I denotes identity matrix, [ K ] := { 1 , . . .
, K } , the superscript T denotes transposition, ◦ denotes composition, (cid:12) denotes Hadamard product, 1 denotes the vector with all components equal one.
For a vector v , v k denotes its k th component and (cid:107) v (cid:107) p denotes its l p norm for p > 0 .
conv ( X ) denote the convex hull of X .
M λ ( a, b ) :=
λa + (1 − λ ) b , for random variables a, b, λ .
δ z denotes the
Dirac delta function, deﬁned as δ z ( x )
=
if x = z and δ z ( x ) = 0 otherwise.
1 A denotes indicator function of the set A .
For α, β > 0 , ˜ D
λ :=
αα + β Beta ( α + 1 , β ) + βα + β Beta ( β + 1 , α ) denotes a uniform mixture of two Beta distributions.
For two vectors a, b , cos( a, b ) := (cid:104) a, b (cid:105) / (cid:107) a (cid:107) 2 (cid:107) b
(cid:107)denotes their cosine similarity.
N ( a, b ) is a Gaussian distribution with mean a and covariance b .
R ELATED W ORK
Regularization.
Regularization refers to any technique that reduces overﬁtting in machine learning; see (Mahoney & Orecchia, 2011; Mahoney, 2012) and references therein, in particular for a discussion of implicit regularization, a topic that has received attention recently in the context of stochastic gradient optimization applied to neural network models.
Traditional regularization techniques such as ridge regression, weight decay and dropout do not make use of the training data to reduce the model capacity.
A powerful class of techniques is data augmentation, which constructs additional examples from the training set, e.g., by applying geometric transformations to the original data (Shorten & Khoshgoftaar, 2019).
A recently proposed technique is mixup (Zhang et al., 2017), where the examples are created by taking convex combinations of pairs of inputs and their labels.
Verma et al.
(2019) extends mixup to hidden representations in deep neural networks.
Subsequent works by Greenewald et al.
; Yin et al.
(2021); Engstrom et al.
Kim et al.
(2020a)
; Yun et al.
; Hendrycks et al.
(2019) introduce different variants and extensions of mixup.
Regularization is also intimately connected to robustness (Hoffman et al., 2019; Sokoli´c et al., 2017; Novak et al., 2018; Elsayed et al., 2018; Moosavi-Dezfooli et al., 2019).
Adding to the list is NFM, a powerful regularization method that we propose to improve model robustness.
Robustness.
Model robustness is an increasingly important issue in modern machine learning.
Robustness with respect to adversarial examples (Kurakin et al., 2016) can be achieved by adversarial training (Goodfellow et al., 2014; Madry et al., 2017; Utrera et al., 2020).
Several works present theoretical justiﬁcations to observed robustness and how data augmentation can improve it (Hein &
Andriushchenko, 2017; Yang et al., 2020b; Couellan, 2021; Pinot et al., 2019a; 2021; Zhang et al., 2020; 2021; Carratino et al., 2020; Kimura, 2020; Dao et al., 2019; Wu et al., 2020; Gong et al., 2020; Chen et al., 2020).
Relatedly, Fawzi et al. (2016); Franceschi et al.
; Lim et al.
(2021) investigate how noise injection can be used to improve robustness.
Parallel to this line of work, we provide theory to understand how NFM can improve robustness.
Also related is the study of the trade-offs between robustness and accuracy (Min et al., 2020;
Zhang et al., 2019;
Tsipras et al., 2018;
Schmidt et al., 2018;
Su et al., 2018; Raghunathan et al., 2020;
Yang et al., 2020a).
N OISY F EATURE M IXUP
Noisy Feature Mixup is a generalization of input mixup (Zhang et al., 2017) and manifold mixup (Verma et al., 2019).
The main novelty of NFM against manifold mixup lies in the injection of noise when taking convex combinations of pairs of input and hidden layer features .
Fig.
1 illustrates, at a high level, how this modiﬁcation alters the region in which the resulting augmented data resides.
Fig.
2 shows that NFM is most effective at smoothing the decision boundary of the trained classiﬁers; compared to noise injection and mixup alone, it imposes the strongest smoothness on this dataset.
Formally, we consider multi-class classiﬁcation with K labels.
Denote the input space by X ⊂ R d and the output space by Y = R K .
The classiﬁer, g , is constructed from a learnable map f : X → R K , mapping an input x to its label, g ( x ) =
arg max k f k ( x ) ∈
[ K ] .
We are given a training set,
Z n := { ( x i , y i ) } n i =1 , consisting of n pairs of input and one-hot label, with each training pair z i :=
( x i , y i ) ∈
X × Y drawn i.i.d.
from a ground-truth distribution D .
We consider training a deep neural network f :=
f k ◦ g k , where g k : X → g k ( X ) maps an input to a hidden representation at layer k , and f k : g k ( X ) → g L ( X ) :
= Y maps the hidden representation to a one-hot label at layer L .
Here, g k ( X ) ⊂ R d k for k ∈ [ L ] , d L :=
K , g 0 ( x ) = x and f 0 ( x ) =
f
( x ) .
Training f using NFM consists of the following steps:
Select a random layer k from a set, S ⊂ { 0 } ∪ [ L ] , of eligible layers in the neural network.
Process two random data minibatches ( x, y ) and ( x (cid:48) , y (cid:48) ) as usual, until reaching layer k .
This gives us two immediate minibatches ( g k ( x ) , y ) and ( g k ( x (cid:48) ) , y (cid:48) ) .
Perform mixup on these intermediate minibatches, producing the mixed minibatch:
[Equation]
where the mixing level λ ∼ Beta ( α, β ) , with the hyper-parameters α, β > 0 . 4.
Produce noisy mixed minibatch by injecting additive and multiplicative noise:
[Equation]
where the ξ addk and ξ multk are R d k -valued independent random variables modeling the additive and multiplicative noise respectively, and σ add , σ mult ≥ 0 are pre-speciﬁed noise levels.
Continue the forward pass from layer k until the output using the noisy mixed minibatch (˜˜ g k , ˜ y ) .
Compute the loss and gradients that update all the parameters of the network.
Baseline (85.5%).
Dropout (87.0%). Weight decay (88.0%).
Noise injections (87.0%). Mixup (84.5%). Manifold mixup (88.5%). Noisy mixup (89.
[Figure]
At the level of implementation, following (Verma et al., 2019), we backpropagate gradients through the entire computational graph, including those layers before the mixup layer k .
In the case where σ add = σ mult = 0 , NFM reduces to manifold mixup (Verma et al., 2019).
If in addition S = { 0 } , it reduces to the original mixup method (Zhang et al., 2017).
The main difference between NFM and manifold mixup lies in the noise injection of the fourth step above.
Note that
NFM is equivalent to injecting noise into g k ( x ) , g k ( x (cid:48) )
ﬁrst, then performing mixup on the resulting pair, i.e., the order that the third and fourth steps occur does not change the resulting noisy mixed minibatch.
For simplicity, we have used the same mixing level, noise distribution, and noise levels for all layers in S in our formulation.
Within the above setting, we consider the expected NFM loss:
[Equation]
where l : R K × R K → [0 , ∞ ) is a loss function (note that here we have suppressed the dependence of both l and f on the learnable parameter θ in the notation), ξ k :=
( ξ addk , ξ multk ) are drawn from some probability distribution Q with ﬁnite ﬁrst two moments, and
[Equation]
NFM seeks to minimize a stochastic approximation of L NFM ( f ) by sampling a ﬁnite number of k, λ, ξ k values and using minibatch gradient descent to minimize this loss approximation.
T HEORY
In this section, we provide mathematical analysis to understand NFM.
We begin with formulating
NFM in the framework of vicinal risk minimization and interpreting NFM as a stochastic learning strategy in Subsection 4.1.
Next, we study NFM via the lens of implicit regularization in Subsection 4.2.
Our key contribution is Theorem 1, which shows that minimizing the NFM loss function is approximately equivalent to minimizing a sum of the original loss and feature-dependent regularizers, amplifying the regularizing effects of manifold mixup and noise injection according to the mixing and noise levels.
In Subsection 4.3, we focus on demonstrating how NFM can enhance model robustness via the lens of distributionally robust optimization.
The key result of Theorem 2 shows that NFM loss is approximately the upper bound on a regularized version of an adversarial loss, and thus training with NFM not only improves robustness but can also mitigate robust over-ﬁtting, a dominant phenomenon where the robust test accuracy starts to decrease during training (Rice et al., 2020).
4. NFM: B EYOND E MPIRICAL R ISK M INIMIZATION
The standard approach in statistical learning theory (Bousquet et al., 2003) is to select a hypothesis function f : X → Y from a pre-deﬁned hypothesis class F to minimize the expected risk with respect to D and to solve the risk minimization problem: inf f ∈F R ( f ) :
=
E ( x,y ) ∼D
[ l ( f ( x ) , y )] , for a suitable choice of loss function l .
In practice, we do not have access to the ground-truth distribution.
Instead, we ﬁnd an approximate solution by solving the empirical risk minimization (ERM) problem, in which case D is approximated by the empirical distribution P n = 1 n (cid:80) ni =
δ z i .
In other words, in
ERM we solve the problem: inf f ∈F R n ( f ) :
= 1 n (cid:80) ni =1 l ( f ( x i ) , y i ) .
However, when the training set is small or the model capacity is large (as is the case for deep neural networks), ERM may suffer from overﬁtting.
Vicinal risk minimization (VRM) is a data augmentation principle introduced in (Vapnik, 2013) that goes beyond ERM, aiming to better estimate expected risk and reduce overﬁtting.
In VRM, a model is trained not simply on the training set, but on samples drawn from a vicinal distribution, that smears the training data to their vicinity.
With appropriate choices for this distribution, the VRM approach has resulted in several effective regularization schemes (Chapelle et al., 2001).
Input mixup (Zhang et al., 2017) can be viewed as an example of VRM, and it turns out that NFM can be constructed within a VRM framework at the feature level (see Section A in SM ).
On a high level, NFM can be interpreted as a random procedure that introduces feature-dependent noise into the layers of the deep neural network.
Since the noise injections are applied only during training and not inference, NFM is an instance of a stochastic learning strategy.
Note that the injection strategy of NFM differs from those of An (1996); Camuto et al.
; Lim et al.
Here, the structure of the injected noise differs from iteration to iteration (based on the layer chosen) and depends on the training data in a different way.
We expect NFM to amplify the beneﬁts of training using either noise injection or mixup alone, as will be shown next.
4. I MPLICIT R EGULARIZATION OF NFM
We consider loss functions of the form l ( f ( x ) , y ) :
= h ( f ( x ))
− yf ( x ) , which includes standard choices such as the logistic loss and the cross-entropy loss, and recall that f :=
f k ◦ g k .
Denote
L stdn :
= 1 n (cid:80) ni =1 l ( f ( x i ) , y i ) and let D x be the empirical distribution of training samples { x i } i ∈ [ n ] .
We shall show that NFM exhibits a natural form of implicit regularization, i.e., regularization imposed implicitly by the stochastic learning strategy, without explicitly modifying the loss.
Let (cid:15) > 0 be a small parameter.
In the sequel, we rescale 1 − λ
(cid:55)→ (cid:15) (1 − λ ) , σ add (cid:55)→ (cid:15)σ add , σ mult (cid:55)→ (cid:15)σ mult , and denote ∇ k f and ∇ 2 k f as the ﬁrst and second directional derivative of f k with respect to g k respectively, for k ∈ S .
By working in the small parameter regime, we can relate the
NFM empirical loss L NFMn to the original loss
L stdn and identify the regularizing effects of NFM.
Theorem 1.
Let (cid:15) > 0 be a small parameter, and assume that h and f are twice differentiable.
Then,
L [Equation]
∼S L [Equation] n , where
[Equation]
with ˜ R ( k ) = R
[Equation]
and ˜
[Equation]
, where
[Equation]
[Equation]
Here, R k 1 , R k 2 and R k 3 are the regularizers associated with the loss of manifold mixup (see Theoremin SM for their explicit expression), and ϕ is some function such that lim (cid:15) → 0 ϕ ( (cid:15) )
= 0 .
Theorem 1 implies that, when compared to manifold mixup, NFM introduces additional smoothness, regularizing the directional derivatives, ∇ k f ( g k ( x i )) and ∇ 2 k f ( g k ( x i )) , with respect to g k ( x i ) , according to the noise levels σ add and σ mult , and amplifying the regularizing effects of manifold mixup and noise injection.
In particular, making ∇ 2 f ( x i ) small can lead to smooth decision boundaries (at the input level), while reducing the conﬁdence of model predictions.
On the other hand, making the ∇ k f ( g k ( x i )) small can lead to improvement in model robustness, which we discuss next.
4. R OBUSTNESS OF NFM
We show that NFM improves model robustness.
We do this by considering the following three lenses: (1) implicit regularization and classiﬁcation margin; (2) distributionally robust optimization; and (3) a probabilistic notion of robustness.
We focus on (2) in the main paper.
See Section C-D in SM and the last paragraph in this subsection for details on (1) and (3).
We now demonstrate how NFM helps adversarial robustness.
By extending the analysis of Zhang et al.
; Lamb et al.
(2019), we can relate the NFM loss function to the one used for adversarial training, which can be viewed as an instance of distributionally robust optimization (DRO) (Kwon et al., 2020; Kuhn et al., 2019; Rahimian & Mehrotra, 2019) (see also Proposition 3.1 in (Staib &
Jegelka, 2017)).
DRO provides a framework for local worst-case risk minimization, minimizing supremum of the risk in an ambiguity set, such as in the vicinity of the empirical data distribution.
Following (Lamb et al., 2019), we consider the binary cross-entropy loss, setting h ( z )
= log(1 + e z ) , with the labels y taking value in { 0 , 1 } and the classiﬁer model f : R d → R .
In the following, we assume that the model parameter θ ∈ Θ :=
{ θ : y i f ( x i )
+ ( y i − 1) f
( x i ) ≥ 0 for all i ∈ [ n ] } .
Note that this set contains the set of all parameters with correct classiﬁcations of training samples (before applying NFM), since { θ : 1 { f ( x i ) ≥ 0 } =
y i for all i ∈
[ n ] } ⊂ Θ .
Therefore, the condition of θ ∈ Θ is satisﬁed when the model classiﬁes all labels correctly for the training data before applying NFM.
Since, in practice, the training error often becomes zero in ﬁnite time, we study the effect of NFM on model robustness in the regime of θ ∈ Θ .
Working in the data-dependent parameter space Θ , we have the following result.
Theorem 2.
Let θ ∈ Θ :=
{ θ : y i f ( x i )
+ ( y i − 1) f
( x i ) ≥ 0 for all i ∈ [ n ] } such that ∇ k f
( g k ( x i )) and ∇ 2 k f ( g k ( x i )) exist for all i ∈ [ n ] , k ∈ S .
Assume that f k ( g k ( x i ))
= ∇ k f ( g k ( x i ))
T g k ( x i ) , ∇ 2 k f ( g k ( x i ))
=
for all i ∈ [ n ] , k ∈ S .
In addition, suppose that (cid:107)∇ f ( x i ) (cid:107) 2 > 0 for all i ∈ [ n ] ,
E r ∼D x [ g k ( r )] =
and (cid:107) g k
( x i ) (cid:107) 2 ≥ c ( k ) x √ d k for all i ∈ [ n ] , k ∈ S .
Then,
[Equation]
where (cid:15) mixi :
[Equation]
( k )
[Equation]
and φ is some function such that lim (cid:15) → 0 φ ( (cid:15) )
= 0 .
The second assumption stated in Theorem 2 is similar to the one made in Lamb et al.
; Zhang et al.
(2020), and is satisﬁed by linear models and deep neural networks with ReLU activation function and max-pooling.
Theorem 2 shows that the NFM loss is approximately an upper bound of the adversarial loss with l 2 attack of size (cid:15) mix = min i ∈ [ n ] (cid:15) mixi , plus a feature-dependent regularization term L regn (see SM for further discussions).
Therefore, we see that minimizing the NFM loss not only results in a small adversarial loss, while retaining the robustness beneﬁts of manifold mixup, but it also imposes additional smoothness, due to noise injection, on the adversarial loss.
The latter can help mitigate robust overﬁtting and improve test performance (Rice et al., 2020; Rebufﬁ et al., 2021).
NFM can also implicitly increase the classiﬁcation margin (see Section C of SM ).
Moreover, since the main novelty of NFM lies in the introduction of noise injection, it would be insightful to isolate the robustness boosting beneﬁts of injecting noise on top of manifold mixup.
We demonstrate these advantages via the lens of probabilistic robustness in Section D of SM .
E MPIRICAL R ESULTS
In this section, we study the test performance of models trained with NFM, and examine to what extent NFM can improve robustness to input perturbations.
We demonstrate the tradeoff between predictive accuracy on clean and perturbed test sets.
We consider input perturbations that are common in the literature: (a) white noise; (b) salt and pepper; and (c) adversarial perturbations (see Section F).
We evaluate the average performance of NFM with different model architectures on CIFAR10 (Krizhevsky, 2009), CIFAR-100 (Krizhevsky, 2009), ImageNet (Deng et al., 2009), and CIFAR10c (Hendrycks & Dietterich, 2019).
We use a pre-activated residual network (ResNet) with depth 18 (He et al., 2016) on small scale tasks.
For more challenging tasks, we consider the performance of wide ResNet-18 (Zagoruyko & Komodakis, 2016) and ResNet-50 architectures, respectively.
Baselines.
We evaluate against related data augmentation schemes that have shown performance improvements in recent years: mixup (Zhang et al., 2017); manifold mixup (Verma et al., 2019); cutmix (Yun et al., 2019); puzzle mixup (Kim et al., 2020b); and noisy mixup (Yang et al., 2020b).
Further, we compare to vanilla models trained without data augmentation (baseline), models trained with label smoothing, and those trained on white noise perturbed inputs.
Experimental details.
All hyperparameters are consistent with those of the baseline model across the ablation experiments.
In the models trained on the different data augmentation schemes, we keep α ﬁxed, i.e., the parameter deﬁning Beta ( α, α ) , from which the λ parameter controlling the convex combination between data point pairs is sampled.
Across all models trained with NFM, we control the level of noise injections by ﬁxing the additive noise level to σ add = 0 .
4 and multiplicative noise to σ mult = 0 .
To demonstrate the signiﬁcant improvements on robustness upon the introduction of these small input perturbations, we show a second model (‘*’)
that was injected with higher noise levels (i.e., σ add = 1 . 0 , σ mult = 0 . 5 ).
See SM (Section F.5) for further details and comparisons against NFM models trained on various other levels of noise injections.
5. CIFAR
Pre-activated ResNet-18.
Table 1 summarizes the performance improvements and indicates a consistent robustness across different α values.
The model trained with NFM outperforms the baseline model on the clean test set, while being more robust to input perturbations (Fig. 3; left).
This advantage is also displayed in the models trained with mixup and manifold mixup, though in a less pronounced way.
Notably, the NFM model is also robust to salt and pepper perturbations and could be signiﬁcantly more so by further increasing the noise levels (Fig. 3; right).
5. CIFAR-
Wide ResNet-18.
Previous work indicates that data augmentation has a positive effect on performance for this dataset (Zhang et al., 2017).
Fig.
4 (left) conﬁrms that mixup and manifold mixup improve the generalization performance on clean data and highlights the advantage of data augmentation.
The NFM training scheme is also capable of further improving the generalization performance.
In
[Figure]
e s t
A cc u r ac y
[Figure]
[Table]
[Figure]
[Table] [Table]
addition, we see that the model trained with NFM is less sensitive to both white noise and salt and pepper perturbations.
These results are surprising
[Table]
as robustness is often thought to be at odds with accuracy (Tsipras et al., 2018).
However
[Table]
we demonstrate NFM has the ability to improve both accuracy and robustness.
Table 2 indicates that for the same α , NFM can achieve an average test accuracy of 80 .
9% compared to only 80 .
3% in the mixup setting
[Table]
5. I MAGE N ET
ResNet-50.
Table 3 similarly shows that NFM improves both the generalization and robustness capacities with respect to data perturbations.
Although less pronounced in comparison to previous datasets, NFM shows a favorable trade-off without requiring additional computational resources.
Note that due to computational costs, we do not average across multiple seeds and only compare
NFM to the baseline and manifold mixup models.
5. CIFAR-10 C
In Figure 6 we use the CIFAR-10C dataset (Hendrycks & Dietterich, 2019) to demonstrate that models trained with NFM are more robust to a range of perturbations on natural images.
Figure 6 (left) shows
[Figure] [Figure]
the average test accuracy across six selected perturbations and demonstrates the advantage of NFM being particularly pronounced with the progression of severity levels.
The right ﬁgure shows the performance on the same set of six perturbations for the median severity level 3.
NFM excels on
Gaussian, impulse, speckle and shot noise
[Figure]
and is competitive with the rest on the snow perturbation.
5. R OBUSTNESS TO A DVERSARIAL E XAMPLES
So far we have only considered white noise and salt and pepper perturbations.
We further consider adversarial perturbations.
Here, we use projected gradient decent (Madry et al., 2017) with 7 iterations and various (cid:15) levels to construct the adversarial perturbations.
Fig.
5 highlights the improved resilience of ResNets trained with NFM to adversarial input perturbations and shows this consistently on both
CIFAR-10 (left) and CIFAR-100 (right). Models trained with both mixup and manifold mixup do not show a substantially increased resilience to adversarial perturbations.
In Section F.6, we compare NFM to models that are adversarially trained.
There, we see that adversarially trained models are indeed more robust to adversarial attacks, while at the same time being less accurate on clean data.
However, models trained with NFM show an advantage compared to adversarially trained models when faced with salt and pepper perturbations.
C ONCLUSION
We introduce Noisy Feature Mixup, an effective data augmentation method that combines mixup and noise injection.
We identify the implicit regularization effects of NFM, showing that the effects are ampliﬁcations of those of manifold mixup and noise injection.
Moreover, we demonstrate the beneﬁts of NFM in terms of superior model robustness, both theoretically and experimentally.
Our work inspires a range of interesting future directions, including theoretical investigations of the trade-offs between accuracy and robustness for NFM and applications of NFM beyond computer vision tasks.
Further, it will be interesting to study whether NFM may also lead to better model calibration by extending the analysis of Thulasidasan et al.
; Zhang et al.
C ODE OF E THICS
We acknowledge that we have read and commit to adhering to the ICLR Code of Ethics.
R EPRODUCIBILITY
The codes that can be used to reproduce the empirical results, as well as description of the data processing steps, presented in this paper are available as a zip ﬁle in Supplementary Material at
OpenReview.net.
The codes are also available at https://github.com/erichson/NFM .
For the theoretical results, all assumptions, proofs and the related discussions are provided in SM .
A CKNOWLEDGMENTS
S. H. Lim would like to acknowledge the WINQ Fellowship and the Knut and Alice Wallenberg
Foundation for providing support of this work.
N. B. Erichson and M. W. Mahoney would like to acknowledge IARPA (contract W911NF20C0035), NSF and ONR for providing partial support of this work.
Our conclusions do not necessarily reﬂect the position or the policy of our sponsors, and no ofﬁcial endorsement should be inferred.
We are also grateful for the generous support from Amazon AWS Supplementary Material (SM) for “Noisy Feature Mixup”
Organizational Details.
This SM is organized as follows.
• In Section A, we study the regularizing effects of NFM within the vicinal risk minimization framework, relating the effects to those of mixup and noise injection.
• In Section B, we restate the results presented in the main paper and provide their proof.
• In Section C, we study robutsness of NFM through the lens of implicit regularization, showing that NFM can implicitly increase the classiﬁcation margin.
• In Section D, we study robustness of NFM via the lens of probabilistic robustness, showing that noise injection can improve robustness on top of manifold mixup while keeping track of maximal loss in accuracy incurred under attack by tuning the noise levels.
• In Section E, we provide results on generalization bounds for NFM and their proofs, identifying the mechanisms by which NFM can lead to improved generalization bound.
• In Section F, we provide additional experimental results and their details.
We recall the notation that we use in the main paper as well as this SM .
Notation.
I denotes identity matrix, [ K ] := { 1 , . . .
, K } , the superscript T denotes transposition, ◦ denotes composition, (cid:12) denotes Hadamard product, 1 denotes the vector with all components equal one.
For a vector v , v k denotes its k th component and (cid:107) v (cid:107) p denotes its l p norm for p > 0 .
conv ( X ) denote the convex hull of X .
M λ ( a, b ) :=
λa + (1 − λ ) b , for random variables a, b, λ .
δ z denotes the
Dirac delta function, deﬁned as δ z ( x )
=
if x = z and δ z ( x ) = 0 otherwise.
1 A denotes indicator function of the set A .
For α, β > 0 , ˜ D
λ :=
αα + β Beta ( α + 1 , β ) + βα + β Beta ( β + 1 , α ) , a uniform mixture of two Beta distributions.
For two vectors a, b , cos( a, b ) := (cid:104) a, b (cid:105) / (cid:107) a (cid:107) 2 (cid:107) b (cid:107) 2 denotes their cosine similarity.
N ( a, b ) denotes the Gaussian distribution with mean a and covariance b .
A NFM T HROUGH THE L ENS OF V ICINAL R ISK M INIMIZATION
In this section, we shall show that NFM can be constructed within a vicinal risk minimization (VRM) framework at the level of both input and hidden layer representations.
To begin with, we deﬁne a class of vicinal distributions and then relate NFM to such distributions.
Deﬁnition 1 (Randomly perturbed feature distribution) .
Let Z n = { z 1 , . . .
, z n } be a feature set.
We say that P (cid:48) n is an e i -randomly perturbed feature distribution if there exists a set { z (cid:48) 1 , . . .
, z (cid:48) n } such that P (cid:48) n = 1 n (cid:80) ni
=1 δ z (cid:48)
i , with z (cid:48)
i =
z i
+ e i , for some random variable e i (possibly dependent on Z n ) drawn from a probability distribution.
Note that the support of an e i -randomly perturbed feature distribution may be larger than that of Z .
If Z n is an input dataset and the e i are bounded variables such that (cid:107) e i (cid:107) ≤ β for some β ≥ 0 , then P (cid:48)
n is a β -locally perturbed data distribution according to Deﬁnition 2 in (Kwon et al., 2020).
Examples of β -locally perturbed data distribution include that associated with denoising autoencoder, input mixup, and adversarial training (see Example 1-3 in (Kwon et al., 2020)).
Deﬁnition 1 can be viewed as an extension of the deﬁnition in (Kwon et al., 2020), relaxing the boundedness condition on the e i to cover a wide families of perturbed feature distribution.
One simple example is the Gaussian distribution, i.e., when e i ∼ N (0 , σ 2 i ) , which models Gaussian noise injection into the features.
Another example is the distribution associated with NFM, which we now discuss.
To keep the randomly perturbed distribution close to the original distribution, the amplitude of the perturbation should be small.
In the sequel, we let (cid:15) > 0 be a small parameter and rescale 1 − λ (cid:55)→ (cid:15) (1 − λ ) , σ add (cid:55)→ (cid:15)σ add and σ mult (cid:55)→ (cid:15)σ mult .
Let F k be the family of mappings from g k ( X ) to Y and consider the VRM:
[Equation]
where P ( k ) n = 1 n (cid:80) ni =
δ ( g (cid:48) k
( x i ) ,y (cid:48) i ) , with g (cid:48) k
( x i ) =
g k
( x i )
+ (cid:15)e NFM ( k ) i and y (cid:48)
i =
y i
+ (cid:15)e yi , for some random variables e NFM ( k ) i and e y
i .
In NFM, we approximate the ground-truth distribution D using the family of distributions { P ( k ) n } k ∈S , with a particular choice of ( e NFM ( k ) i , e yi ) .
In the sequel, we denote NFM at the level of k th layer as
NFM ( k ) (i.e., the particular case when S := { k } ).
The following lemma identiﬁes the ( e NFM ( k ) i , e yi ) associated with NFM ( k ) and relates the effects of NFM ( k ) to those of mixup and noise injection, for any perturbation level (cid:15) > 0 .
Lemma 1.
Let (cid:15) > 0 and denote z i ( k ) :
= g k ( x i ) .
Learning the neural network map f using
NFM ( k ) is a VRM with the ( (cid:15)e NFM ( k ) i , (cid:15)e yi ) -randomly perturbed feature distribution, P ( k ) n = 1 n (cid:80) ni
=1 δ ( z (cid:48)
i ( k ) ,y (cid:48) i ) , with z (cid:48) i ( k ) :
=
z i ( k )+ (cid:15)e NFM ( k ) i , y (cid:48) i :=
y i + (cid:15)e yi , as the vicinal distribution.
Here, e yi =
(1 − λ )
(˜ y i − y i ) ,
[Equation]
(11) where e mixup ( k ) i = (1 − λ )
(˜ z i ( k ) − z i ( k )) , and e noise ( k ) i = σ mult ξ mult (cid:12) z i ( k ) + σ add ξ add , with z i ( k ) ,
˜ z i ( k ) ∈
g k ( X ) , λ ∼ Beta ( α, β ) and y i , ˜ y i ∈ Y .
Here, (˜ z i ( k ) , ˜ y i ) are drawn randomly from the training set.
Therefore, the random perturbation associated to NFM is data-dependent, and it consists of a randomly weighted sum of that from injecting noise into the feature and that from mixing pairs of feature samples.
As a simple example, one can take ξ add , ξ mult to be independent standard
Gaussian random variables, in which case we have e noise ( k ) i ∼ N (0 , σ 2 add I + σ 2 mult diag
( z i ( k )) 2 ) , and e i ∼ N (0 , σ 2 add + σ 2 mult M λ
( z i ( k ) , ˜ z i ( k )) 2 ) in Lemma 1.
We now prove Lemma 1.
Proof of Lemma 1.
Let k be given and set (cid:15)
= 1 without loss of generality.
For every i ∈ [ n ] ,
NFM ( k ) injects noise on top of a mixed sample z (cid:48)
i ( k ) and outputs:
[Equation]
where e NFM ( k ) i =
[Equation]
)(˜
[Equation]
add
[Equation]
add .
Now, note that applying mixup to the pair ( z i ( k ) ,
˜ z i ( k )) results in z (cid:48)
i ( k ) =
z i ( k ) + e mixup ( k ) i , with e mixup ( k ) i
[Equation]
z i ( k )) , where z i ( k ) , ˜ z i ( k ) ∈
g k ( X ) and λ ∼ Beta ( α, β ) , whereas applying noise injection to z i ( k ) results in ( 1 + σ mult ξ mult ) (cid:12) z i ( k )+ σ add ξ add =
z i ( k )
+ e noise ( k ) i , with e noise ( k ) i =
σ mult ξ mult (cid:12)
z i ( k ) + σ add ξ add .
Rewriting e NFM ( k ) i in terms of e mixup ( k ) i and e noise ( k ) i gives
[Equation]
Similarly, we can derive the expression for e yi using the same argument.
The results in the lemma follow upon applying the rescaling 1 − λ
(cid:55)→ (cid:15) (1 − λ ) , σ add (cid:55)→ (cid:15)σ add and σ mult (cid:55)→ (cid:15)σ mult , for (cid:15) > 0 .
B S TATEMENTS AND P ROOF OF THE R ESULTS IN THE M AIN P APER B. C OMPLETE S TATEMENT OF T HEOREM 1 IN THE M AIN P APER AND THE P ROOF
We ﬁrst state the complete statement of Theorem 1 in the main paper.
Theorem 3 (Theorem 1 in the main paper) .
Let (cid:15) > 0 be a small parameter, and assume that h and f are twice differentiable.
Then, L NFMn =
E k ∼S L NFM ( k ) n , where
[Equation]
with
[Equation]
where
[Equation]
g
[Equation]
x
[Equation] [Equation]
25) and ϕ ( (cid:15) ) =
E λ ∼ ˜ D
λ E x r
∼D
x
E ξ k ∼Q
[ ϕ
[Equation]
)] , with ϕ some function such that lim (cid:15) → 0 ϕ ( (cid:15) )
= 0 .
Following the setup of Zhang et al.
(2020), we provide empirical results to show that the second order
Taylor approximation for the NFM loss function is generally accurate (see Figure 7).
Recall from the main paper that the NFM loss function to be minimized is L NFMn =
E k ∼S L NFM ( k ) n , where
[Equation]
where l : R K × R K → [0 , ∞ ) is a loss function of the form l ( f ( x ) , y )
=
h ( f ( x )) − yf ( x ) , ξ k :=
( ξ addk , ξ multk ) are drawn from some probability distribution Q with ﬁnite ﬁrst two moments (with zero mean), and
[Equation]
Before proving Theorem 3, we note that, following the argument of the proof of Lemma 3.1 in Zhang et al.
(2020), the loss function minimized by NFM can be written as follows.
For completeness, we provide all details of the proof.
Lemma 2.
The NFM loss (26) can be equivalently written as L NFMn =
E k ∼S L NFM ( k ) n , where
L NFM ( k ) n
[Equation]
with e
[Equation]
+
[Equation]
Here e mixup ( k ) i = (1 − λ )( g k ( x r ) − g k
( x i )) and e noise ( k ) i =
σ mult ξ multk (cid:12) g k
( x i ) + σ add ξ addk , with g k ( x i ) , g k (
x r ) ∈ g k
( X ) and λ ∼ Beta ( α, β ) .
Proof of Lemma 2.
From (26)
[Equation]
we have:
[Equation]
We can rewrite:
[Equation]
33) where Bern ( λ ) denotes the Bernoulli distribution with parameter λ (i [Equation]
e., P [ B = 1] = λ and
P [ B = 0]
= 1 − λ ).
Note that λ ∼ Beta ( α, β ) and B | λ ∼ Bern ( λ ) .
By conjugacy, we can switch their order:
[Equation]
and arrive at:
[Equation] [Equation]
Using the facts that Beta ( β + 1 , α ) and 1 − Beta ( α, β + 1) are of the same distribution and
M 1 − λ ( x i , x j )
=
M λ ( x j , x i ) , we have:
[Equation]
Therefore, denoting ˜ D
λ :=
αα + β Beta ( α + 1 , β ) + βα + β Beta ( β + 1 , α ) and D x := 1 n (cid:80) nj =
δ x j the empirical distribution induced by the training samples { x j } j ∈ [ n ] , we have:
[Equation]
k
[Equation]
The statement of the lemma follows upon substituting the fact that M λ, ξ k ( g k ( x i ) , g k ( x r )) =
g k
( x i )
+ (cid:15)e NFM ( k ) i into the above equation.
With this lemma in hand, we now prove Theorem 3.
Proof of Theorem 3.
Denote ψ i ( (cid:15) ) :
=
h ( f k ( g k ( x [Equation] + (cid:15)e
[Equation]
where e NFM ( k ) i is given in (29).
Since h and f k are twice differentiable by assumption, ψ i is twice differentiable in (cid:15) , and
[Equation]
where ϕ i is some function such that lim (cid:15) → 0 ϕ i ( (cid:15) )
= 0 .
Therefore, by Lemma 2, L NFMn =
E k ∼S L NFM ( k ) n , where
[Equation]
where ϕ ( (cid:15) )
=
1 n (cid:80)
[Equation]
∼
[Equation]
It remains to compute ψ (cid:48)
i (0) and ψ (cid:48)(cid:48) i (0) in order to arrive at the expression for the R ( k ) 1 , ˜ R ( k )and ˜ R ( k ) 3 presented in Theorem 3.
Denoting ˜ g
k
( x i ) :
= g k ( x i ) + (cid:15)e NFM ( k ) i , we compute, applying chain rule: ψ [Equation] f [Equation]
[Equation]
[Equation]
where we have used ∂
˜ g k
( x i ) ∂(cid:15) =
e NFM ( k ) i in the second last line and substituted the expression for e NFM ( k ) i from (29) in the last line above.
Therefore,
[Equation] [Equation]
and
[Equation]
where we have used the assumptions that E ξ k ∼Q ξ addk = 0 and E ξ k ∼Q ξ multk = 0 .
The expression for the R ( k ) 1 in the theorem then follows from substituting (49) into (42)
[Equation]
Next, using chain rule
[Equation]
we have:
[Equation]
Note that, applying chain rule,
[Equation]
Also, using chain rule again,
[Equation]
Therefore
[Equation]
we have:
[Equation]
[Equation]
where we have substituted the expression for the e NFM ( k ) i into the ﬁrst line to arrive at the last line above.
Note that,
[Equation]
as (cid:15) → 0 , where we have used the assumption that E ξ k ∼Q ξ addk = 0 and E ξ k ∼Q ξ multk = 0 in the second last line above.
Similarly,
[Equation]
as (cid:15) → 0 .
Now, recall from Eq.
(42) that we have
[Equation]
( k ) 1 + (cid:15)
( ˜ R ( k ) 2 + ˜ R ( k ) 3 )
+ (cid:15) 2 ϕ
( (cid:15) ) , (67) where ψ i (0) =
h ( f k ( g k ( x i ))) − y i f
k
( g k ( x i )) .
Also, we have:
E ξ k ∼Q [ ψ (cid:48)(cid:48) i ( (cid:15) )]
= h (cid:48)(cid:48)
( f k (˜ g k ( x i ))) ∇ k f k (˜ g k
( x i ))
T E ξ k ∼Q
[ P 1 ( (cid:15) )] ∇ k f k (˜ g k
( x i ))
+ ( h (cid:48) ( f k (˜ g k
( x i )))
− y i )
E ξ k ∼Q [ P 2 ( (cid:15) )] (68) =
h (cid:48)(cid:48)
( f k (˜ g k ( x i ))) ∇ k f k (˜ g k
( x i ))
T [(1 − λ ) 2 ( g k ( x r ) − g k
( x i ))
( g k ( x r ) − g k
( x i ))
T + σ 2 add E ξ k ∼Q [ ξ add k ( ξ add k ) T ] + σ 2 mult E ξ k ∼Q [( ξ mult k ( ξ mult k ) T ) (cid:12)
g k ( x i ))
g k ( x i ) T ] + o ( (cid:15) )]
× ∇ k f k (˜ g k
( x i ))
+ ( h (cid:48) ( f k (˜ g k
( x i )))
− y i )
[(1 − λ ) 2 ( g k ( x r ) − g k
( x i ))
T ∇ 2 k f k (˜ g k
( x i ))
( g k ( x r ) − g k
( x i ))
+ σ 2 add E ξ k ∼Q [( ξ addk )
T ∇ 2 k f k (˜ g k
( x i ))
ξ addk ] + σ 2 mult
[Table]
[Table]
Therefore, setting (cid:15) = 0 ,
[Equation]
The expression for the ˜ R ( k ) 2 and ˜ R ( k ) 3 in the theorem follows upon substituting (70) into (66).
B
T HEOREM 2 IN THE M AIN P APER AND THE P ROOF
We ﬁrst restate Theorem 2 in the main paper and then provide the proof.
Recall that we consider the binary cross-entropy loss, setting h ( z )
= log(1 + e z ) , with the labels y taking value in { 0 , 1 } and the classiﬁer model f : R d → R .
Theorem 4 (Theorem 2 in the main paper) .
Let θ ∈ Θ :=
{ θ : y i f ( x i )
+( y i − 1) f
( x i ) ≥ 0 for all i ∈ [ n ] } be a point such that ∇ k f
( g k ( x i )) and ∇ 2 k f ( g k ( x i )) exist for all i ∈ [ n ] , k ∈ S .
Assume that f k ( g k ( x i ))
= ∇ k f ( g k ( x i ))
T g k ( x i ) , ∇ 2 k f ( g k ( x i ))
=
for all i ∈ [ n ] , k ∈ S .
In addition, suppose that (cid:107)∇
[Equation]
for all i ∈ [ n ] , E r ∼D
x [ g k ( r )] = 0 and (cid:107)
g k ( x i ) (cid:107) 2 ≥ c ( k ) x √ d k for all i ∈ [ n ] , k ∈ S .
Then,
[Equation]
71) where
[Equation]
74) with
[Equation]
and φ is some function such that lim (cid:15) → 0 φ ( (cid:15) )
= 0 .
Theorem 4 says that L NFMn is approximately an upper bound of sum of an adversarial loss with l 2attack of size (cid:15) mix
= min i (cid:15) mixi and a feature-dependent regularizer with the strength of min i ( (cid:15) regi ) 2 .
Therefore, minimizing the NFM loss would result in a small regularized adversarial loss.
We note that both (cid:15) mixi and (cid:15) regi depend on the cosine similarities between the directional derivatives and the features at which the derivatives are evaluated at, whereas the (cid:15) regi additionally depend on the cosine similarities between the directional derivatives and the injected noise.
Before proving Theorem 4, we remark that the assumption that f k ( g k ( x i ))
= ∇ k f ( g k ( x i ))
T g k ( x i ) , ∇ 2 k f ( g k ( x i ))
=
for all i ∈ [ n ] , k ∈ S is satisﬁed by fully connected neural networks with ReLU activation function or max-pooling.
For a proof of this, we refer to Section B.2 in Zhang et al.
The assumption that E r ∼D x [ g k ( r )] = 0 could be relaxed at the cost of obtaining a more complicated formula (see Remark 1 for the formula) for the (cid:15) regi in the bound, which could be derived in a straightforward manner.
Proof of Theorem 4.
For h ( z )
= log(1 + e z ) , we have h (cid:48)
( z ) =
e z 1+ e z =: S ( z ) ≥ 0 and h (cid:48)(cid:48)
( z ) =
e z (1+ e z )
=
S
( z )(1 − S ( z )) ≥ 0 .
Substituting these expressions into the equation of Theorem 3 and using the assumptions that f k ( g k ( x i ))
= ∇ k f ( g k ( x i ))
T g k ( x i ) and E r ∼D x
[ g k ( r )] = 0 , we have, for k ∈ S ,
[Equation]
and we compute:
[Equation]
In the above, we have used the facts that E
[ Z 2 ] =
E [ Z ] 2 + V ar ( Z ) ≥ E [ Z ] 2 and S, S (1 − S ) ≥ 0 to obtain (78), the assumption that E r ∼D x [
g k ( r )] = 0 to arrive at (79), the assumption that (cid:107) g k ( x i ) (cid:107) 2 ≥ c ( k ) x √ d k for all i ∈ [ n ] , k ∈ S to arrive at (82), and the assumption that (cid:107)∇ f ( x i ) (cid:107) 2 > 0 for all i ∈ [ n ] to justify the last equation above.
Next, we bound R ( k ) 1 , using the assumption that θ ∈ Θ .
Note that from our assumption on θ , we have y i f
( x i )
+ ( y i − 1) f
( x i ) ≥ 0 , which implies that f ( x i ) ≥ 0 if y i
= 1 and f ( x i ) ≤ 0 if y i = 0 .
Thus, if y i = 1 , then ( y i − S ( f ( x i )))
f k ( g k ( x i ))
= (1 − S ( f ( x i )))
f k ( g k ( x i )) ≥ 0 , since f ( x i ) ≥ 0 and (1 − S ( f ( x i ))) ≥
due to the fact that S ( f ( x i )) ∈ (0 , 1) .
A similar argument leads to ( y i − S ( f ( x i )))
f k ( g k ( x i )) ≥
if y i = 0 .
So, we have ( y i − S ( f ( x i )))
f k ( g k ( x i )) ≥
for all i ∈ [ n ] .
Therefore, noting that E λ ∼ ˜ D λ [1 − λ ] ≥ 0 , we compute:
[Equation]
Note that R ( k )= 0 as a consequence of our assumption that ∇ 2 k f
( g k ( x i ))
=
for all i ∈ [ n ] , k ∈ S , and similar argument leads to:
[Equation]
Using Theorem 3 and the above results
[Equation]
we obtain:
[Equation]
On the other hand
[Equation]
for any small parameters (cid:15) i > 0 and any inputs z 1 , . . .
[Equation]
z n
[Equation]
we can, using a second-order Taylor expansion and then applying our assumptions
[Equation]
compute:
[Equation]
[Equation]
) where the ϕ (cid:48) i are functions such that lim
z → 0 ϕ (cid:48)
i ( z ) = 0 , ϕ (cid:48)(cid:48) i ( (cid:15) i ) :
= max (cid:107) δ i (cid:107) 2 ≤ (cid:15) i ϕ (cid:48)
i ( δ i ) and lim z → 0 ϕ (cid:48)(cid:48) i ( z )
= 0 .
Combining (94) and (97), we see that
[Equation]
[Equation]
where L regn is deﬁned in the theorem.
Noting that lim [Table] → [Table]
) = 0 , the proof is done.
Remark 1.
Had we assumed that E r ∼D x [ g k ( r )] (cid:54) = 0 , then the statements of Theorem 4 remain unchanged, but with ( (cid:15) regi ) 2 replaced by
[Equation] [Equation]
C NFM T HROUGH THE L ENS OF I MPLICIT R EGULARIZATION AND C LASSIFICATION M ARGIN
First, we deﬁne classiﬁcation margin at the input level.
We shall show that minimizing the NFM loss can lead to an increase in the classiﬁcation margin, and therefore improve model robustness in this sense.
Deﬁnition 2 (Classiﬁcation Margin) .
The classiﬁcation margin of a training input-label sample s i :=
( x i , c i ) measured by the Euclidean metric d is deﬁned as the radius of the largest d -metric ball in X centered at x i that is contained in the decision region associated with the class label
c i , i.e., it is: γ d ( s i ) =
sup { a : d ( x i , x ) ≤ a ⇒ g
( x ) =
c i ∀ x } .
Intuitively, a larger classiﬁcation margin allows a classiﬁer to associate a larger region centered on a point x i in the input space to the same class.
This makes the classiﬁer less sensitive to input perturbations, and a perturbation of x i is still likely to fall within this region, keeping the classiﬁer prediction.
In this sense, the classiﬁer becomes more robust.
In the typical case, the networks are trained by a loss (cross-entropy) that promotes separation of different classes in the network output.
This, in turn, maximizes a certain notion of score of each training sample (Sokoli ´ c et al., 2017).
Deﬁnition 3 (Score) .
For an input-label training sample s i
=
( x i , c i ) , we deﬁne its score as o ( s i )
=
min j (cid:54) =
c i √ 2( e c i − e j ) T f ( x i ) ≥ 0 , where e i ∈ R K is the Kronecker delta vector (one-hot vector) with e ii = 1 and e ji = 0 for i (cid:54) =
j .
A positive score implies that at the network output, classes are separated by a margin that corresponds to the score.
A large score may not imply a large classiﬁcation margin, but score can be related to classiﬁcation margin via the following bound.
Proposition 1.
Assume that the score o
( s i ) > 0 and let k ∈ S .
Then, the classiﬁcation margin for the training sample s i can be lower bounded as:
[Equation]
(101) where C ( s i ) =
o ( s i ) / sup x ∈ conv ( X ) (cid:107)∇ g k ( x ) (cid:107) 2 .
Since NFM implicitly reduces the feature-output Jacobians ∇ k f (including the input-output Jacobian) according to the mixup level and noise levels (see Proposition 3), this, together with Theorem 1, suggests that applying NFM implicitly increases the classiﬁcation margin, thereby making the model more robust to input perturbations.
We note that a similar, albeit more involved, bound can also be obtained for the all-layer margin, a more reﬁned version of classiﬁcation margin introduced in (Wei & Ma, 2019b), and the conclusion that applying NFM implicitly increases the margin also holds.
We now prove the proposition.
Proof of Proposition 1.
Note that, for any k ∈ S , ∇ f ( x ) = ∇ k f ( g k ( x )) ∇ g k ( x ) by the chain rule, and so
[Equation]
The statement in the proposition follows from a straightforward application of Theorem 4 in (Sokoli´c et al., 2017) together with the above bound.
D NFM T HROUGH THE L ENS OF P ROBABILISTIC R OBUSTNESS
Since the main novelty of NFM lies in the introduction of noise injection, it would be insightful to isolate the robustness boosting beneﬁts of injecting noise on top of manifold mixup.
We shall demonstrate the isolated beneﬁt in this section.
The key idea is based on the observation that manifold mixup produces minibatch outputs that lie in the convex hull of the feature space at each iteration.
Therefore, for k ∈ S , NFM ( k ) can be viewed as injecting noise to the layer k features sampled from some distribution over conv ( g k ( X )) , and so the NFM ( k ) neural network F k can be viewed as a probabilistic mapping from conv ( g k ( X ))
to
P ( Y ) , the space of probability distributions on Y .
To isolate the beneﬁt of noise injection, we adapt the approach of (Pinot et al., 2019a; 2021) to our setting to show that the Gaussian noise injection procedure in NFM robustiﬁes manifold mixup in a probabilistic sense.
At its core, this probabilistic notion of robustness amounts to making the model locally Lipschitz with respect to some distance on the input and output space, ensuring that a small perturbation in the input will not lead to large changes (as measured by some probability metric) in the output.
Interestingly, it is related to a notion of differential privacy (Lecuyer et al., 2019; Dwork et al., 2014), as formalized in (Pinot et al., 2019b).
We now formalize this probabilistic notion of robustness.
Let p > 0 .
We say that a standard model f : X → Y is α p
-robust if for any ( x, y ) ∼ D such that f ( x ) =
y , one has, for any data perturbation τ ∈ X , (cid:107)
[Equation]
Analogous deﬁnition can be formulated when output of the model is distribution-valued.
Deﬁnition 4 (Probabilistic robustness) .
A probabilistic model F : X → P ( Y ) is called ( α p , (cid:15) ) -robust with respect to D if, for any x, τ ∈ X , one has
[Equation]
where D is a metric or divergence between two probability distributions.
We refer to the probabilistic model (built on top of a manifold mixup classiﬁer) that injects Gaussian noise to the layer k features as probabilistic FM model , and we denote it by F noisy ( k ) : conv ( g k ( X ))
→ P ( Y ) .
We denote G as the classiﬁer constructed from F noisy ( k ) , i.e., G : x (cid:55)→ arg max j ∈
[ K ] [ F noisy ( k ) ]
j
( x ) .
In the sequel, we take D to be the total variation distance D TV , deﬁned as:
[Equation]
) for any two distributions P and Q over X .
Recall that if P and Q have densities ρ p and ρ q respectively, then the total variation distance is half of the L 1 distance, i.e., D TV ( P, Q ) = 12 (cid:82) X | ρ p ( x ) −
ρ q ( x ) | dx .
The choice of the distance depends on the problem on hand and will give rise to different notions of robustness.
One could also consider other statistical distances such as the Wasserstein distance and
Renyi divergence, which can be related to total variation (see (Pinot et al., 2021; Gibbs & Su, 2002) for details).
Before presenting our main result in this section, we need the following notation.
Let Σ( x ) :
= σ 2 add I + σ 2 mult xx T .
For x, τ ∈ X , let Π x be a d k by d k − 1 matrix whose columns form a basis for the subspace orthogonal to g k
( x + τ ) − g k
( x ) , and { ρ i ( g k ( x ) , τ ) } i ∈
[ d k − 1] be the eigenvalues of (Π Tx Σ( g k ( x ))
Π x ) − 1 Π Tx Σ( g k ( x + τ ))
Π x − I .
Also, let [ F ] topk ( x ) denote the k th highest value of the entries in the vector F ( x ) .
Viewing an NFM ( k ) classiﬁer as a probabilistic FM classiﬁer, we have the following result.
Theorem 5 (Gaussian noise injection robustiﬁes FM classiﬁers) .
Let k ∈ S , d k > 1 , and assume that g k ( x ) g k ( x ) T ≥ β 2 k I > 0 for all x ∈ conv ( X ) for some constant β k .
Then, F noisy ( k ) is ( α p , (cid:15) k
( p, d, α p , σ add , σ mult ))
-robust with respect to D TV against l p adversaries, with
[Equation]
where
[Equation]
with
[Equation]
p
[Equation]
if
[Equation]
and
B
[Equation]
Moreover, if x ∈ X is such that [ F noisy ( k ) ] top 1 ( x ) ≥ [ F noisy ( k ) ] top
[Equation]
( x ) + 2 (cid:15) ( p
[Equation] d, α p [Equation] σ add , σ mult ) , then for any τ ∈ X , we have
[Equation]
for any p > 0 .
Theorem 5 implies that we can inject Gaussian noise into the feature mixup representation to improve robustness of FM classiﬁers in the sense of Deﬁnition 4, while keeping track of maximal loss in accuracy incurred under attack, by tuning the noise levels σ add and σ mult .
To illustrate this, suppose that σ mult = 0 and consider the case of p = 2 , in which case A = 0 , B ∼ α 2 /σ add and so injecting additive Gaussian noise can help controlling the change in the model output, keeping the classiﬁer’s prediction, when the data perturbation is of size α 2 .
We now prove Theorem 5.
Before this, we need the following lemma.
Lemma 3.
Let x 1 :=
z ∈ R d k and x 2 :=
z + τ ∈ R d k , with τ > 0 and d k > 1 , and Σ( x ) :
= σ 2 add I + σ 2 mult xx T ≥ ( σ 2 add + σ 2 mult β 2 ) I > 0 , for some constant β , for all x .
Let Π be a d k by d k −matrix whose columns form a basis for the subspace orthogonal to τ , and let ρ 1 ( z, τ ) , . .
, ρ d k − 1 ( z, τ ) denote the eigenvalues of (Π T Σ( x 1 )Π) − 1 Π T Σ( x 2 )
Π − I .
Deﬁne the function C ( x 1 , x 2 , Σ) :=
max { A, B } , where
[Equation]
Then, the total variation distance between N ( x 1 , Σ( x 1 )) and N ( x 2 , Σ( x 2 )) admits the following bounds:
[Equation]
Proof of Lemma 3.
The result follows from a straightforward application of Theorem 1.2 in (Devroye et al., 2018), which provides bounds on the total variation distance between Gaussians with different means and covariances.
With this lemma in hand, we now prove Theorem 5.
Proof of Theorem 5.
We denote the noise injection procedure by the map I : x
→ N ( x, Σ( x )) , where Σ( x ) = σ 2 add I + σ 2 mult xx T .
Let x ∈ X be a test datapoint and τ ∈ X be a data perturbation such that (cid:107) τ (cid:107) p ≤ α p for p > 0 .
Note that
[Equation]
where τ k :=
g k
( x + τ ) − g k
( x ) = (cid:16)(cid:82) 1 0 ∇ g k ( x + tτ )
dt (cid:17) τ by the generalized fundamental theorem of calculus, and
[Equation]
[Equation]
(120) where the ρ i ( g k ( x ) , τ ) are the eigenvalues given in the theorem.
In the ﬁrst line above, we have used the data preprocessing inequality (Theorem 6 in (Pinot et al., 2021)), and the last line follows from applying Lemma 3 together with the assumption that g k ( x ) g k ( x ) T ≥ β 2 k > 0 for all x .
Using the bounds
[Equation]
121) and
[Equation]
(122) we have Φ
[Equation]
[Equation] [Equation]
[Equation]
mult , β
[Equation]
≤ max { A, B } , (123) where
A = σ 2 mult
[Equation]
[Equation]
2 (cid:107) τ (cid:107)(cid:19) (124) and
B = (cid:13)(cid:13)(cid:13)(cid:82) 1 0 ∇ g k ( x + tτ ) dt
(cid:13)(cid:13)(cid:13) 2 (cid:107) τ (cid:107)(cid:112) σ 2 add + σ 2 mult β 2 k (cid:118)(cid:117)(cid:117)(cid:116)
d k − 1 (cid:88) i =
ρ 2 i ( g k ( x ) , τ ) (125) ≤ sup x ∈ conv ( X ) (cid:18) (cid:13)(cid:13)(cid:13)(cid:13)(cid:90)0 ∇ g k ( x + tτ ) dt (cid:13)(cid:13)(cid:13)(cid:13) 2 · (cid:118) (cid:117)(cid:117)(cid:116)
d k − 1 (cid:88) i =
ρ 2 i ( g k ( x ) , τ ) (cid:19) (cid:107) τ (cid:107) 2 (cid:112) σ 2 add + σ 2 mult β 2 k (126)
=:
B k ( τ ) (cid:107) τ (cid:107) 2 (cid:112) σ 2 add + σ 2 mult β 2 k .
The ﬁrst statement of the theorem then follows from the facts that (cid:107) τ (cid:107) 2 ≤
(cid:107) τ (cid:107) p ≤ α p for p ∈ (0 , 2] , (cid:107) τ (cid:107) 2 ≤ d 1 / 2 − 1 /q (cid:107) τ (cid:107) q ≤ d 1 / 2 − 1 /q
α q for q > 2 , and (cid:107) τ (cid:107) 2 ≤ √ d (cid:107) τ (cid:107) ∞ ≤ √ dα ∞ for any τ ∈ R d .
In particular, these imply that A ≤ CA p , where
[Equation]
and
C :=
[Equation]
The last statement in the theorem essentially follows from Proposition 3 in (Pinot et al., 2021).
E O N G ENERALIZATION B OUNDS FOR NFM
Let F be the family of mappings x
(cid:55)→ f ( x ) and Z n := (( x i , y i ))
i ∈ [ n ] .
Given a loss function l , the
Rademacher complexity of the set l ◦ F := { ( x, y ) (cid:55)→ l ( f ( x ) , y ) : f ∈ F} is deﬁned as:
[Equation]
where σ := ( σ 1 , . . .
, σ n ) , with the σ i independent uniform random variables taking values in {− 1 , 1 } .
Following (Lamb et al., 2019), we can derive the following generalization bound for the NFM loss function, i.e., the upper bound on the difference between the expected error on unseen data and the NFM loss.
This bound shows that NFM can reduce overﬁtting and give rise to improved generalization.
Theorem 6 (Generalization bound for the NFM loss) .
Assume that the loss function l satisﬁes | l ( x, y ) − l ( x (cid:48) , y ) | ≤ M for all x, x (cid:48) and y .
Then, for every δ > 0 , with probability at least 1 − δ over a draw of n i.i.d.
samples { ( x i , y i ) } ni =1 , we have the following generalization bound: for all maps f ∈ F ,
[Equation]
where
[Equation] [Equation]
for some function ϕ such that lim x →∞ ϕ
( x ) = 0 .
To compare the generalization behavior of NFM with that without using NFM, we also need the following generalization bound for the standard loss function.
Theorem 7 (Generalization bound for the standard loss) .
Assume that the loss function l satisﬁes | l ( x, y ) − l ( x (cid:48) , y ) | ≤ M for all x, x (cid:48) and y .
Then, for every δ > 0 , with probability at least 1 − δ over a draw of n i.i.d.
samples { ( x i , y i ) } ni =1 , we have the following generalization bound: for all maps f ∈ F ,
[Equation]
By comparing the above two theorems and following the argument of (Lamb et al., 2019), we see that the generalization beneﬁt of NFM comes from two mechanisms.
The ﬁrst mechanism is based on the term Q (cid:15) ( f ) .
Assuming that the Rademacher complexity term is the same for both methods, then NFM has a better generalization bound than that of standard method if Q (cid:15) ( f ) > 0 .
The second mechanism is based on the Rademacher complexity term R n ( l ◦ F ) .
For certain families of neural networks, this term can be bounded by the norms of the hidden layers of the network and the norms of the Jacobians of each layer with respect to all previous layers (Wei & Ma, 2019a;b).
Therefore, this term differs for the case of training using NFM and the case of standard training.
Since NFM implicitly reduces the feature-output Jacobians (see Theorem 3), we can argue that NFM leads to a smaller Rademacher complexity term and hence a better generalization bound.
We now prove Theorem 6.
The proof of Theorem 7 follows the same argument as that of Theorem 6.
Proof of Theorem 6.
Let Z n := { ( x i , y i ) } i ∈ [ n ] and Z (cid:48) n := { ( x (cid:48)
i , y (cid:48) i ) } i ∈ [ n ] be two test datasets, where
Z (cid:48) n differs from Z n by exactly one point of an arbitrary index i 0 .
Denote GE ( Z n ) := sup f ∈F E x,y
[ l ( f ( x ) , y )] − L NFMn , where L NFMn is computed using the dataset
Z n , and likewise for GE ( Z (cid:48) n ) .
Then,
[Equation]
[Equation]
where we have used the fact that L NFMn has n 2 terms and there are 2 n − 1 different terms for Z n and Z (cid:48) n .
Similarly, we have GE ( Z n ) − GE ( Z (cid:48) n ) ≤ 2 Mn .
Therefore, by McDiarmid’s inequality, for any δ > 0 , with probability at least 1 − δ ,
[Equation]
Applying Theorem 3, we have
[Equation]
(cid:35) + 2 M (cid:114) ln(1 /δ )
2 n (136) =
E Z n (cid:34) sup f ∈F E Z (cid:48) n (cid:34)n n (cid:88) i
= l ( f ( x (cid:48) i ) , y (cid:48) i ) (cid:35) −n n (cid:88)
i
= l ( f ( x i ) , y i ) (cid:35) − Q (cid:15) ( f ) + 2 M (cid:114) ln(1 /δ )
2 n (137) ≤ E Z n ,Z (cid:48) n (cid:34) sup f ∈F n n (cid:88) i =
( l ( f ( x (cid:48) i ) , y (cid:48)
i ) − l ( f ( x i ) , y i )) (cid:35) − Q (cid:15) ( f ) + 2 M (cid:114) ln(1 /δ )
2 n (138) ≤ E Z n ,Z (cid:48) n ,σ (cid:34) sup f ∈F n n (cid:88) i =
σ i ( l ( f ( x (cid:48) i ) , y (cid:48) i ) − l ( f ( x i ) , y i ))
(cid:35) − Q (cid:15) ( f ) + 2 M (cid:114) ln(1 /δ )
2 n (139) ≤ 2 E Z n ,σ (cid:34) sup f ∈F n n (cid:88) i =
σ i l ( f ( x i ) , y i ) (cid:35) − Q (cid:15) ( f ) + 2 M (cid:114) ln(1 /δ )
2 n (140) = 2 R n ( l ◦ F ) − Q (cid:15)
[Equation]
where (136) uses the deﬁnition of GE ( Z n ) , (137) uses ± 1 n (cid:80) ni
=1 l ( f ( x i ) , y i ) inside the expectation and the linearity of expectation, (138) follows from the Jensen’s inequality and the convexity of the supremum, (139) follows from the fact that σ i ( l ( f ( x (cid:48) i ) , y (cid:48) i ) − l ( f ( x i ) , y i )) and l ( f ( x (cid:48) i ) , y (cid:48) i ) − l ( f ( x i ) , y i ) have the same distribution for each σ i ∈ {− 1 , 1 } (since Z n , Z (cid:48) n are drawn i.i.d.
with the same distribution), and (140) follows from the subadditivity of supremum.
The bound in the theorem then follows from the above bound.
F A DDITIONAL E XPERIMENTS AND D ETAILS F. I NPUT P ERTURBATIONS
We consider the following three types of data perturbations during inference time:
• White noise perturbations are constructed as ˜ x
= x + ∆ x , where the additive noise is sampled from a Gaussian distribution ∆ x ∼ N (0 , σ ) .
This perturbation strategy emulates measurement errors that can result from data acquisition with poor sensors (where σ corresponds to the severity of these errors).
• Salt and pepper perturbations emulate defective pixels that result from converting analog signals to digital signals.
The noise model takes the form P ( ˜ X = X )
= 1 − γ , and P ( ˜ X = max) =
P ( ˜ X = min)
=
γ/ 2 , where ˜ X ( i, j ) denotes the corrupted image and min , max denote the minimum and maximum pixel values, respectively.
γ parameterizes the proportion of defective pixels.
• Adversarial perturbations are “worst-case” non-random perturbations that maximize the loss (cid:96) ( g δ ( X + ∆ X ) , y ) subject to the constraint (cid:107) ∆ X (cid:107) ≤ r on the norm of the perturbation.
We consider the projected gradient decent for constructing these perturbations (Madry et al., 2017).
F. I LLUSTRATION OF THE E FFECTS OF NFM ON T OY D ATASETS
We consider a binary classiﬁcation task for the noise corrupted 2D dataset whose data points form two concentric circles.
Points on the same circle corresponds to the same label class.
We generate 500 samples, setting the scale factor between inner and outer circle to be 0.05 and adding Gaussian noise with zero mean and standard deviation of 0.3 to the samples.
Fig.
8 shows the training and test data points.
We train a fully connected feedforward neural network that has four layers with the
ReLU activation functions on these data, using 300 points for training and 200 for testing.
All models are trained with Adam and learning rate 0 . 1 , and the seed is ﬁxed across all experiments.
Note that the learning rate can be considered as a temperature parameter which introduces some amount of regularization itself.
Hence, we choose a learning rate that is large for this problem to better illustrate the regularization effects imposed by the different schemes that we consider.
Fig.
2 illustrates how different regularization strategies affect the decision boundaries of the neural network classiﬁer.
The decision boundaries and the test accuracy indicate that white noise injections and dropout (we explore dropout rates in the range [0 . 0 , 0 . 9] and we ﬁnds that 0 .
2 yields the best performance) introduce a favorable amount of regularization.
Most notably is the effect of weight decay (we use 9 e − 3 ), i.e., the decision boundary is nicely smoothed and the test accuracy is improved.
In contrast, the simple mixup data augmentation scheme shows no beneﬁts here, whereas manifold mixup is improving the predictive accuracy considerably.
Combining mixup (manifold mixup) with noise injections yields the best performance in terms of both smoothness of the decision boundary and predictive accuracy.
Indeed, NFM is outperforming all other methods here.
The performance could be further improved by combining NFM with weight decay or dropout.
This shows that there are interaction effects between different regularization schemes.
In practice, when
[Figure] [Figure]
T e s t
A cc u r ac y
White Noise ( σ )
[Figure]
[Table]
one trains deep neural networks, different regularization strategies are considered as knobs that are ﬁne-tuned.
From this perspective
[Table]
NFM provides additional knobs to further improve a model.
F. A DDITIONAL R ESULTS FOR V ISION T RANSFORMERS
Here we consider compact vision transformer (ViT-lite) with 7 attention layers and 4 heads (Hassani et al., 2021).
Fig.
9 (left) compares vision transformers trained with different data augmentation strategies.
Again, NFM improves the robustness of the models while achieving state-of-the-art accuracy when evaluated on clean data.
However, mixup and manifold mixup do not boost the robustness.
Further, Fig. 9 (right) shows that that the vision transformer is less sensitive to salt and pepper perturbations as compared to the ResNet model.
These results are consistent with the high robustness properties of transformers recently reported in Shao et al.
; Paul & Chen (2021).
Table 4 provides additional results for different α values.
Table 4 shows results for vision transformers trained with different data augmentation schemes and different values of α .
It can be seen that NFM with α = 0 .
1 helps to improve the predictive accuracy on clean data while also improving the robustness of the models.
For example, the model trained with NFM shows about a 25% improvement compared to the baseline model when faced with salt and paper perturbations ( γ = 0 . 2 ).
Further, our results indicate that larger values of α have a negative effect on the generalization performance of vision transformer.
F. A BLATION S TUDY
In Table 5 we provide a detailed ablation study where we vary several knobs.
First, we can see that just injecting noise helps to improve robustness, but the test accuracy is only marginally improving.
On the other hand, just mixing inputs and hidden features improves the testing performance of the model, but it does not signiﬁcantly improve the robustness of a model.
In contrast, the NFM scheme combines best of both worlds and shows that both accuracy and robustness can be increased.
Varying the noise levels indicate that there is a trade-off between test accuracy on clean data and robustness to perturbations.
We also vary the mixup parameter α to show that the good performance is consistent across a range of different values.
[Table]
F. A DDITIONAL R ESULTS FOR R ES N ETS WITH H IGHER L EVELS OF N OISE I NJECTIONS
In the experiments in Section 5, we considered models trained with NFM that use noise injection levels σ add = 0 .
4 and σ mult = 0 .
2 , whereas the ablation model uses σ add = 1 . 0 and σ mult = 0 .
Here, we want to better illustrate the trade-off between accuracy and robustness.
We saw that there exists a potential sweet-spot where we are able to improve both the predictive accuracy and the robustness of the model.
However, if the primary aim is to push the robustness of the model, then we need to sacriﬁce some amount of accuracy.
Fig.
10 is illustrating this trade-off for pre-actived ResNet-18s trained on CIFAR-10.
We can see that increased levels of noise injections considerably improve the robustness, while the accuracy on clean data points drops.
In practice, the amount of noise injection that the user chooses depend on the situation.
If robustness is critical, than higher noise levels can be used.
If adversarial examples are the main concern, than other training strategies such as adversarial training might be favorable.
However, the advantage of NFM over adversarial training is that (a) we have a more favorable trade-off between robustness and accuracy in the small noise regime, and (b) NFM is computationally inexpensive, when compared to most adversarial training schemes.
This is further illustrated in the next section.
F. C OMPARISON WITH A DVERSARIAL T RAINED M ODELS
Here, we compare NFM to adversarial training in the small noise regime,
i
[Figure]
e., the situation where models do not show a signiﬁcant drop on the clean test set.
Speciﬁcally, we consider the projected gradient decent (PGD) method (Madry et al., 2017) using 7 attack iterations and varying l 2 per-
[Figure] [Figure]
T e s t
A cc u r ac y
[Figure]
turbation levels (cid:15) to train adversarial robust models.
First, we compare how resilient the different models are with respect to adversarial input perturbations during inference time (Fig. 11; left).
Again the adversarial examples are constructed using the PGD method with 7 attack iterations.
Not very surprisingly, the adversarial trained model with (cid:15) = 0 .
01 features the best resilience while sacriﬁcing about 0 .
5% accuracy as compared to the baseline model (here not shown).
In contrast, the models trained with NFM are less robust, while being about 1 − 1 .
5% more accurate on clean data.
Next, we compare in (Fig. 11; right) the robustness with respect to salt and pepper perturbations,
i
[Figure]
e., perturbations that both models have not seen before.
Interestingly, here we see an advantage of the
NFM scheme with high noise injection levels as compared to the adversarial trained models.
F. F EATURE V ISUALIZATION C OMPARISON
In this subsection, we concern ourselves with comparing the features learned by three ResNet50 models trained on Restricted Imagenet (Tsipras et al., 2018): without mixup, manifold mixup (Verma et al., 2019), and NFM.
We can compare features by maximizing randomly chosen pre-logit activations of each model with respect to the input, as described by Engstrom et al.
We do so for all models with Projected Gradient Ascent over 200 iterations, a step size of 16, and an (cid:96) 2 norm constraint of 2,000.
Both the models trained with manifold mixup and NFM use an α = 0 . 2 , and the
NFM model uses in addition σ add = 2 . 4 and σ mult = 1 . 2 .
The result, as shown in Fig.
12, is that the features learned by the model trained with NFM are slightly stronger (i.e., different from random noise) than the clean model.
F. T RAIN AND T EST E RROR FOR CIFAR-
Figure 13 shows models trained with different training schemes on CIFAR-100.
Compared to the baseline model, the models trained with manifold mixup and NFM have a similar convergence behavior.
However, they are able to achieve a smaller test error.
This shows that both manifold mixup and NFM have a favorable implicit regularization effect, where the effect is more pronounced for the
NFM scheme.
[Figure] [Figure] [Figure]