Source-linked AI summary
Using Pre-Training Can Improve Model Robustness and Uncertainty
Dan Hendrycks, Kimin Lee, Mantas Mazeika
TL;DR
The paper addresses whether pre-training has value beyond matching traditional classification performance or accelerating convergence. It evaluates pre-training across robustness and uncertainty tasks, finding substantial gains, including improved adversarial robustness and state-of-the-art results.
Problem
Prior work suggested that training from scratch can match pre-training on traditional tasks, leaving its value for robustness and uncertainty unclear.
Method
The paper evaluates pre-training across adversarial examples, label corruption, class imbalance, out-of-distribution detection, and uncertainty estimation, including adversarial pre-training and task-specific methods.
Results
Pre-training substantially improves robustness and uncertainty, including 11.6% and 9.2% absolute adversarial-accuracy gains on CIFAR-10 and CIFAR-100, respectively.
Takeaways & Limitations
Pre-training should be included when evaluating robustness and uncertainty methods because it can complement task-specific techniques and sometimes surpass state-of-the-art performance.
Abstract
from arXiv · showhide
He et al. (2018) have called into question the utility of pre-training by showing that training from scratch can often yield similar performance to pre-training. We show that although pre-training may not improve performance on traditional classification metrics, it improves model robustness and uncertainty estimates. Through extensive experiments on adversarial examples, label corruption, class imbalance, out-of-distribution detection, and confidence calibration, we demonstrate large gains from pre-training and complementary effects with task-specific methods. We introduce adversarial pre-training and show approximately a 10% absolute improvement over the previous state-of-the-art in adversarial robustness. In some cases, using pre-training without task-specific methods also surpasses the state-of-the-art, highlighting the need for pre-training when evaluating future methods on robustness and uncertainty tasks.
1. Introduction
Pre-training remains useful beyond faster convergence: although traditional accuracy may match training from scratch, it improves robustness and uncertainty-related model quality. The paper argues that pre-training should accompany evaluations of robustness and uncertainty.
- Pre-training is widely used for deep convolutional networks, especially when target-task data are scarce, and supports state-of-the-art model convergence.
- He et al. (2018) reported that sufficiently long training from scratch can match pre-trained models, questioning benefits beyond faster convergence.
- Pre-training improves adversarial robustness, label-corruption robustness, class-imbalance robustness, and uncertainty estimates even when traditional accuracy changes little.
- Pre-training produces gains large enough to surpass state-of-the-art performance on many robustness and uncertainty tasks, sometimes without task-specific methods.
- Training longer can cause networks to memorize corrupted labels, harming performance rather than compensating for the absence of pre-training.
- The authors recommend the “pre-train then tune” paradigm for increased performance and greater realism.
2. Related Work
Related work covers transfer learning, adversarial defenses, corrupted-label learning, class-imbalance methods, and uncertainty estimation. These approaches motivate testing whether pre-training complements or outperforms task-specific robustness techniques.
- Prior transfer-learning studies found pre-training benefits robust across substantial changes in the pre-training dataset, including removal of target-related classes.
- He et al. (2018) found that pre-training mainly speeds convergence on large target datasets when training from scratch continues long enough.
- Adversarial training creates white-box adversarial examples during training, but requires substantially longer training times and may need more task-specific data.
- Corrupted-label methods estimate label-noise structure or use trusted clean examples, while prior work shows that excessive training can overfit incorrect labels.
- Class-imbalance strategies rebalance data, reweight losses, or enlarge classifier margins, often incurring time and memory costs.
- Pre-trained and adversarially trained models can have comparable clean accuracy while differing markedly in adversarial accuracy.
- Out-of-distribution detection commonly ranks samples using maximum softmax probability, but improving this baseline without test-distribution knowledge is difficult.
3. Robustness
Pre-training substantially improves robustness across adversarial perturbations, label corruption, and class imbalance, even when traditional accuracy changes little. It also complements task-specific methods and can surpass their performance.
- Adversarial Perturbations: 11.6% and 9.2% absolute adversarial-accuracy improvements over the previous state of the art were obtained on CIFAR-10 and CIFAR-100, respectively.The models used untargeted adversarial pre-training followed by five epochs of adversarial fine-tuning.
- Adversarial Perturbations: Adversarial representations transfer across distributions: tuning only the last affine layer achieves adversarial accuracies of 46.6% on CIFAR-10 and 26.1% on CIFAR-100.This also surpasses the previous adversarial-accuracy state of the art.
- Label Corruption: 45% and 29% relative reductions in label-corruption error-curve area were achieved on CIFAR-10 and CIFAR-100 without correction, yielding new state-of-the-art AUCs of 15.9% and 39.1%.These gains could not be reproduced simply by training longer, because networks eventually memorize corrupted labels.
- Label Corruption: Pre-training complements label-noise correction: with GLC and 5% trusted data, it cuts CIFAR-10 error-curve area in half and outperforms doubling the trusted-data amount.Pre-training without correction can also outperform Forward Correction, motivating evaluation of label-corruption methods with pre-trained networks.
- Label Corruption: Across architectures and datasets, pre-training lowers label-corruption error-curve area, including 23.7% to 14.8% on CIFAR-10 with an All Convolutional Network.The corresponding CIFAR-100 values are 46.5% and 41.0%, showing gains beyond the primary Wide ResNet experiments.
- Class Imbalance: 2.1% versus 12.6%: removing CIFAR-10-related pre-training classes increases total error by only 2.1%, compared with a 12.6% difference between pre-training and SMOTE.The gains largely come from lower error rates on minority classes.
4. Uncertainty
Pre-training improves uncertainty estimates across out-of-distribution detection and confidence calibration, while remaining compatible with task-specific calibration methods.
- Out-of-Distribution Detection: Pre-trained representations directly improve uncertainty estimates without assuming knowledge of the test distribution of anomalies.Anomaly scores use maximum softmax probabilities.
- Out-of-Distribution Detection: Pre-training consistently improves both AUROC and AUPR for out-of-distribution detection, with especially large gains on CIFAR-100.Scores average results across multiple anomalous datasets.
- Calibration: Pre-training at least halves RMS Calibration Error on every dataset, with CIFAR-100 showing the largest improvement.The same pattern holds for MAD error, which falls by a factor of 4.1 on CIFAR-100.
- Calibration: Pre-training gains remain robust across pre-training datasets, with RMS error falling from 6.4 at baseline to 3.1 with Places365 and 2.9 with ImageNet.These values are reported for CIFAR-10.
- Calibration: Temperature tuning further reduces Tiny ImageNet RMS Calibration Error from 4.15 to 3.55 when combined with pre-training.Unlike temperature tuning, pre-training does not require additional data collection.
5. Conclusion
The conclusion argues that pre-training benefits robustness and uncertainty tasks even when traditional accuracy is similar, extending its value beyond faster convergence.
- 5. Conclusion: Pre-training produces models that surpass previous state-of-the-art results on robustness and uncertainty tasks despite similar accuracy on unperturbed data.The conclusion contrasts these gains with the traditional-task findings of He et al. (2018).
- 5. Conclusion: Pre-training with an untargeted adversary surpasses the long-standing state-of-the-art in adversarial accuracy by a significant margin.Robustness to label corruption also improves by wide margins.
- 5. Conclusion: Pre-training alone can outperform certain task-specific methods for robustness, sometimes even after combining those methods with pre-training.The conclusion recommends evaluating future robustness methods with pre-training.
A. CIFAR-10-Related Classes Excluded from Downsampled ImageNet
The appendix lists the ImageNet-1K classes identified as related to CIFAR-10 for exclusion from Downsampled ImageNet pre-training.
- A. CIFAR-10-Related Classes Excluded from Downsampled ImageNet: The appendix enumerates ImageNet-1K class identifiers related to CIFAR-10.These identifiers define the classes referenced by the appendix section title.
B. Evaluating Adversarial Robustness with Random Restarts
Stronger PGD evaluation uses more iterations and random restarts, revealing lower adversarial accuracy than weaker evaluation settings.
- B. Evaluating Adversarial Robustness with Random Restarts: Random restarts and more PGD iterations create stronger adversaries and can reduce the measured accuracy of adversarially trained models.The paper includes these settings for completeness because they were not standard at the time.
- B. Evaluating Adversarial Robustness with Random Restarts: 100-step PGD with 1,000 random restarts reduces adversarially pre-trained CIFAR-10 accuracy to 52.9%.The external evaluation used a 1,000-example subset of the CIFAR-10 test set.
C. Full Out-of-Distribution Detection Results
The paper evaluates out-of-distribution example detection using varied datasets and reports results in Table 6. The table compares maximum softmax probability detection with MSP after pre-training across five-run percentage averages.
- The evaluation uses datasets including Gaussian Noise and Rademacher Noise, following the problem setup from Hendrycks et al. (2019).
- ImageNet-21K is defined as ImageNet-22K with the ImageNet-1K classes held out.
- Table 6 compares the maximum softmax probability baseline detector with the MSP detector after pre-training.
- All Table 6 results are percentages averaged over 5 runs.