Source-linked AI summary
Benchmarking Neural Network Robustness to Common Corruptions and Surface Variations
Dan Hendrycks, Thomas G. Dietterich
TL;DR
Image classifiers remain less robust than human vision to common corruptions and surface changes, motivating broader robustness benchmarks. The paper introduces IMAGENET-C and ICONS-50, evaluates classifiers under these settings, and finds architectural progress can yield little relative corruption-robustness change while modern models remain fragile to surface variation.
Problem
Existing computer vision systems are less robust than human vision to common corruptions and abstract structural or stylistic changes, while robustness research has focused mainly on other challenges.
Method
The paper introduces IMAGENET-C with 75 common visual corruptions and ICONS-50 for evaluating corruption and surface variation robustness.
Results
Modern models are fragile to surface variation, while the paper reports minuscule changes in relative corruption robustness across many years of architectural advances.
Takeaways & Limitations
Benchmarking and improving robustness deserves attention as clean ImageNet top-1 accuracy nears its ceiling, with multiscale architectures and larger models improving corruption robustness.
Takeaways & Limitations
Models evaluated on IMAGENET-C must not be trained on its 75 test corruptions, limiting the benchmark to robustness on corruptions excluded from training.
Abstract
from arXiv · showhide
In this paper we establish rigorous benchmarks for image classifier robustness. Our first benchmark, ImageNet-C, standardizes and expands the corruption robustness topic, while showing which classifiers are preferable in safety-critical applications. Unlike recent robustness research, this benchmark evaluates performance on commonplace corruptions not worst-case adversarial corruptions. We find that there are negligible changes in relative corruption robustness from AlexNet to ResNet classifiers, and we discover ways to enhance corruption robustness. Then we propose a new dataset called Icons-50 which opens research on a new kind of robustness, surface variation robustness. With this dataset we evaluate the frailty of classifiers on new styles of known objects and unexpected instances of known classes. We also demonstrate two methods that improve surface variation robustness. Together our benchmarks may aid future work toward networks that learn fundamental class structure and also robustly generalize.
1 Introduction
The paper establishes benchmarks for corruption robustness and surface variation robustness, addressing gaps in current vision systems and robustness research. These benchmarks target classifiers that generalize beyond superficial cues toward fundamental class structure.
- Human vision handles common corruptions and abstract structural or stylistic changes more robustly than existing computer vision systems.The paper frames this robustness as important for computer vision and essential for safety-critical deployment.
- The paper introduces IMAGENET-C for input corruption robustness and ICONS-50 for surface variation robustness.These benchmarks address robustness forms distinct from adversarial examples, unknown unknowns, and model or data poisoning.
- 75 common visual corruptions are applied to ImageNet to create IMAGENET-C, a benchmark intended to reduce moving goal posts and result cherry picking.The authors report wide room for improvement and introduce methods and architectures that improve robustness without losing accuracy.
- ICONS-50 benchmarks surface variation in which fundamental class structure remains unchanged while styles and other surface statistics vary.The dataset supports research on new styles and novel animal species, and the paper describes two methods that improve surface variation robustness.
- The benchmarks are intended to facilitate classifiers that track fundamental class structure and robustly generalize to unexpected inputs.
2 Related Work
Prior robustness research emphasized adversarial examples, unknown unknowns, poisoning, and corruption fragility. Existing studies also found that narrow corruption-specific fine-tuning often fails to generalize and can reduce performance.
- Deep learning robustness research has focused on adversarial examples, unknown unknowns, and model or data poisoning.
- Speech recognition research places greater emphasis on common acoustic corruptions than worst-case adversarial corruptions because common corruptions are ever-present and unsolved.
- Studies show convolutional networks can be fragile to simple corruptions, while human vision remains more robust to noise and blur.Fine-tuning on specific corruptions was reported not to generalize across corruptions.
- Fine-tuning on one blur type does not generalize to other blurs, and fine-tuning on several blurs can marginally decrease performance.Related work also reports that noisy-image fine-tuning can cause underfitting.
3 The IMAGENET-C Corruption Robustness Benchmark
IMAGENET-C benchmarks classifier robustness using 75 common corruptions across five severity levels, with metrics that separate clean accuracy from corruption-induced degradation. The benchmark shows that relative robustness changed little from AlexNet to ResNet, while several architectural and preprocessing choices improved corruption performance.
- 3.1 The IMAGENET-C Dataset: 75 corruptions span noise, blur, weather, and digital categories, each evaluated at five severity levels on ImageNet validation images.The benchmark tests pre-existing networks trained on clean ImageNet images rather than IMAGENET-C images.
- 3.2 Metric and Setup: Corruption Error aggregates top-1 error across five severity levels for one corruption, while mCE averages the resulting errors across 15 corruption types.Corruption Errors are normalized by AlexNet’s errors to make different corruption types comparable.
- 3.2 Metric and Setup: Relative mCE measures performance degradation under corruption relative to clean-data error, complementing mCE when clean accuracy and corruption robustness diverge.A classifier can have a larger mCE yet degrade more gracefully if its clean-data error is lower.
- 3.3 Architecture Robustness: From AlexNet to ResNet, mCE improved with architecture, but Relative mCE worsened, indicating that robustness itself barely changed as accuracy improved.Relative robustness remained near AlexNet levels and below human-level performance.
- 3.5 Successful Corruption Robustness Enhancements: CLAHE preprocessing reduced ResNet-50 mCE from 76.7% to 74.5% across corruptions.This result reflects a corruption-robustness gain from input preprocessing without changing the classifier architecture.
- 3.5 Successful Corruption Robustness Enhancements: Feature aggregation and model scale improved corruption robustness: DenseNet-121 reduced mCE to 73.4%, DenseNet-161 to 66.4%, and ResNeXt-101 to 62.2%.The reported comparisons pair larger or feature-aggregating models with their corresponding top-1 error rates.
4 Surface Variation Robustness
Surface variation robustness tests whether classifiers recognize fundamental class structure when artistic style or subtype changes without corruption. On ICONS-50, modern classifiers are fragile, while multiscale architectures and Shake-Shake regularization improve robustness.
- 4 Surface Variation Robustness: Surface variation changes an object’s style or subtype while preserving the fundamental structure of its class.The paper evaluates style variation and subtype variation separately.
- 4 Surface Variation Robustness: ICONS-50 contains 10,000 images across 50 icon classes collected from multiple technology companies and platforms, with different styles in each class.The dataset includes categories such as people, food, activities, places, objects, and symbols.
- 4 Surface Variation Robustness: Style robustness holds out icons from one source and measures accuracy on that unseen source, while subtype robustness holds out subtypes and tests broad-class prediction.These protocols assess generalization to new styles and unexpected instances within known classes.
- 4.2 Surface Variation Robustness Experiments with ICONS-50: 58.3% accuracy was achieved by the ResNet on held-out Microsoft-styled icons, compared with 48.5% for DenseNet and 51.8% for ResNeXt.The results show that the evaluated networks lacked style robustness despite training with standard augmentation.
- 4.2 Surface Variation Robustness Experiments with ICONS-50: 65.1% style robustness accuracy was achieved by MSDNet versus 48.5% for DenseNet, while subtype robustness differed by only a fraction of a percent.The paper attributes the multiscale advantage to processing whole-image structure early when style changes preserve structure.
- 4.2 Surface Variation Robustness Experiments with ICONS-50: 76.0% style robustness accuracy was achieved by Shake-Shake ResNeXt versus 51.8% for vanilla ResNeXt, while subtype accuracy rose from 60.0% to 63.6%.The paper notes that subtype robustness was harder to improve than style robustness.
5 Conclusion
The paper introduces benchmarks and datasets for corruption robustness and surface variation robustness. It finds limited changes in relative corruption robustness across architectural advances, fragility to surface variation, and improvements from selected methods.
- 5 Conclusion: The paper introduces what it describes as the first benchmarks for corruption robustness and surface variation robustness.These benchmarks are enabled by the new IMAGENET-C and ICONS-50 datasets.
- 5 Conclusion: Many years of architectural advancements corresponded to minuscule changes in relative corruption robustness.The conclusion argues that robustness benchmarking and improvement deserve attention as clean ImageNet accuracy nears its ceiling.
- 5 Conclusion: Histogram equalization, multiscale architectures, and larger models improve corruption robustness, while some methods harm it.The reported findings concern the paper’s corruption robustness benchmark.
- 5 Conclusion: Modern models are fragile to surface variation, while multiscale networks and highly regularized networks noticeably enhance surface variation robustness.The paper defines style and subtype robustness as two forms of surface variation robustness.
A Example of IMAGENET-C Severities
IMAGENET-C illustrates corruption severity by applying pixelation at five levels, ranging from negligible to pulverizing. This range enables comprehensive assessment of each corruption type.
- A Example of IMAGENET-C Severities: Five pixelation severities show corruption progressing from modest to marked degradation of a fish image.The figure uses pixelation as an example of the benchmark’s varying severities.
- A Example of IMAGENET-C Severities: IMAGENET-C corruption severities range from negligible to pulverizing, enabling comprehensive assessment of each corruption type.The benchmark applies five different severity levels to each corruption type.
B Extra IMAGENET-C Corruptions
The paper provides extra IMAGENET-C corruptions for model validation and experimentation. These additions help avoid overestimating robustness by testing beyond the benchmark’s directly specified corruption types.
- B Extra IMAGENET-C Corruptions: Extra IMAGENET-C corruption examples are provided for model validation and sounder experimentation.The additional corruptions are available for download.
- B Extra IMAGENET-C Corruptions: The paper avoids directly fitting IMAGENET-C corruption types because doing so would overestimate model robustness.Extra corruptions span noise, blur, weather, and digital categories.
- B Extra IMAGENET-C Corruptions: The extra corruption set includes speckle noise, Gaussian blur, spatter, and saturate, covering one type from each listed category.Speckle noise is additive, Gaussian blur averages neighboring pixels, spatter can occlude a lens, and saturate changes image colorfulness.
C Full Corruption Robustness Results
IMAGENET-C reports relative corruption robustness across corruption types, using AlexNet-normalized Corruption Error values and listing results for 19 corruptions.
- The reported relative robustness results are presented for IMAGENET-C in Table 2.
- 19 corruption types receive relative Corruption Error values, ranging from 56.5% for Brightness to 92.3% for Impulse Noise.
D 10-Crop Classification Fails to Enhance Robustness
10-crop classification averages predictions from ten crops and their mirrors, improving accuracy but not noticeably improving robustness on ResNet-50.
- 10-crop classification averages 10 predicted class probability distributions produced from corner, center, and mirrored crops.
- 10-crop classification improves classification accuracy, but its mCE gains do not outpace its accuracy gains on ResNet-50.
- 10-crop classification is computationally expensive and does not noticeably improve robustness.
E Auxiliary Surface Variation Robustness Experiments
Auxiliary experiments evaluate robustness to unseen subtypes and surface-style changes using CIFAR-100, ImageNet-22K, Figure 8, and style transfer.
- CIFAR-100: 59.7% is the average CIFAR-100 broad-class error rate on held-out subtypes, versus 13.2% on subtypes known to the classifier.
- ImageNet-22K: ImageNet-22K experiments define seen subtypes from ImageNet-1K and unseen subtypes from ImageNet-22K outside ImageNet-1K, then compare their accuracies.
- ImageNet-22K: Figure 8 shows that unseen subtypes of known broad classes are noticeably harder for classifiers.
- Style variation: Style transfer provides a synthetic experiment for testing robustness to changes in image style.
F Classes in ICONS-50
ICONS-50 contains 50 classes spanning icons of objects, animals, activities, symbols, and other visual concepts.
- ICONS-50 comprises 50 named classes, including Airplane, Bird, Building, Cat, Flower, Phone, Tree, Vehicle, and Writing Utensil.