PaperlayerView exact revision on arXiv

Source-linked AI summary

Benchmarking Neural Network Robustness to Common Corruptions and Perturbations

Dan Hendrycks, Thomas Dietterich

arXiv:1903.12261v1cs.LGcs.CVstat.ML

TL;DR

Current vision systems remain less robust than humans to common corruptions and perturbations, while prior robustness research has largely emphasized adversarial threats. The paper introduces ImageNet-C and ImageNet-P to benchmark these forms of robustness, finding minuscule changes in relative corruption robustness across architectural advances and instability on simple perturbations.

  • Problem

    Existing vision systems remain less robust than humans to common corruptions and perturbations, while robustness research has largely emphasized adversarial examples and other threats.

  • Method

    The paper introduces ImageNet-C with 75 common corruptions and ImageNet-P with perturbed images and metrics for measuring corruption and perturbation robustness.

  • Results

    Architectural advances produced minuscule changes in relative corruption robustness, while classifiers showed instability on simple perturbations and ALP delivered substantial common-perturbation robustness.

  • Takeaways & Limitations

    The benchmarks support systematic evaluation of corruption and perturbation robustness as targets for research toward networks that robustly generalize.

  • Takeaways & Limitations

    Robustness enhancement experiments require diverse test sets, and simpler models may provide no robustness gains.

Abstract

from arXiv · show

In this paper we establish rigorous benchmarks for image classifier robustness. Our first benchmark, ImageNet-C, standardizes and expands the corruption robustness topic, while showing which classifiers are preferable in safety-critical applications. Then we propose a new dataset called ImageNet-P which enables researchers to benchmark a classifier's robustness to common perturbations. Unlike recent robustness research, this benchmark evaluates performance on common corruptions and perturbations not worst-case adversarial perturbations. We find that there are negligible changes in relative corruption robustness from AlexNet classifiers to ResNet classifiers. Afterward we discover ways to enhance corruption and perturbation robustness. We even find that a bypassed adversarial defense provides substantial common perturbation robustness. Together our benchmarks may aid future work toward networks that robustly generalize.

1 INTRODUCTION

The section motivates robustness benchmarks beyond adversarial examples by introducing ImageNet-C for common corruptions and ImageNet-P for prediction stability under common perturbations. These datasets expose substantial weaknesses in current networks and support standardized evaluation and robustness improvements.

  • Motivation: Human vision remains robust to small image changes, diverse corruptions, and abstract structural or stylistic changes that can fool current deep learning classifiers.Examples include snow, blur, pixelation, and novel combinations of corruptions.
  • Contribution: Unlike prior robustness work centered on adversarial examples, unknown unknowns, and poisoning, the paper develops datasets for corruption and perturbation robustness.The contribution specifically introduces the IMAGETNET-C dataset for input corruption robustness.
  • IMAGENET-C: 75 common visual corruptions applied to ImageNet form IMAGENET-C, a benchmark intended to standardize evaluation and reduce moving goal posts and result cherry picking.Evaluations show wide room for improvement among current deep learning systems.
  • IMAGENET-P: IMAGENET-P measures prediction stability on subtly perturbed ImageNet images and reveals surprising instability even when perturbations are not adversarial.The paper also shows that methods improving corruption robustness can improve perturbation robustness.

2 RELATED WORK

Prior work contrasts worst-case adversarial robustness with robustness to common corruptions, documenting convolutional-network fragility and mixed results from fine-tuning-based enhancements.

  • Adversarial Examples: Adversarial examples are carefully crafted small distortions that can confuse classifiers, serving as a form of worst-case robustness analysis.Studies search for minimal additive RGB distortions, and such distortions can sometimes fool black-box classifiers.
  • Robustness in Speech: Speech recognition research prioritizes common acoustic corruptions, such as street noise, background chatter, and wind, over adversarial audio.This emphasis reflects the prevalence and unresolved nature of corruption in real-world environments, supported by noisy test-audio datasets.
  • ConvNet Fragility Studies: Studies show convolutional networks are fragile under impulse noise, Gaussian noise, blur, and elastic deformations, sometimes remaining less robust than human vision.Reported examples include breaking Google’s Cloud Vision API with impulse noise and demonstrating human superiority after network fine-tuning on Gaussian noise or blur.
  • Robustness Enhancements: Fine-tuning on blurred or noisy images provides limited robustness gains and can harm generalization or cause underfitting.Fine-tuning on one blur type does not generalize to others, several blurs can marginally decrease performance, and noisy-image fine-tuning can cause underfitting.

3 CORRUPTIONS, PERTURBATIONS, AND ADVERSARIAL PERTURBATIONS

This section distinguishes corruption and perturbation robustness from adversarial robustness by contrasting average-case, classifier-agnostic behavior with worst-case, classifier-tailored perturbations. It introduces common corruptions and perturbations, provided through ImageNet-C and ImageNet-P, as practical benchmarks.

  • Corruption robustness measures average-case classifier performance over a set of corruptions and data-distribution samples.It is defined as E_c∼C[P_(x,y)∼D(f(c(x) = y))].
  • Adversarial robustness measures worst-case performance under small, additive, classifier-tailored perturbations.The formulation minimizes over perturbations δ satisfying ∥δ∥_p < b.
  • Perturbation robustness measures average-case prediction stability under small, general, classifier-agnostic input changes.It tracks whether f(ε(x)) = f(x) across perturbations ε sampled from E.
  • The paper designs frequently encountered natural-image corruptions and perturbations, calling them “common” and releasing them through ImageNet-C and ImageNet-P.These datasets approximate the corruption and perturbation sets used in the robustness measures.

4 THE IMAGENET-C AND IMAGENET-P ROBUSTNESS BENCHMARKS

The section introduces ImageNet-C and ImageNet-P as complementary benchmarks for robustness to diverse common corruptions and sequential perturbations. It defines aggregate metrics that quantify corruption severity performance, prediction flips, and top-5 prediction consistency.

  • IMAGENET-C Design: ImageNet-C applies 15 corruption types across noise, blur, weather, and digital categories at five severity levels to ImageNet validation images.The dataset contains 75 corruption instances overall, with each corruption evaluated at five severities.
  • IMAGENET-P Design: ImageNet-P evaluates perturbation robustness using sequences generated from ImageNet validation images, with more than 30 frames per sequence.Its perturbations include noise, blur, weather, and digital distortions, and the benchmark is designed for evaluation rather than training.
  • IMAGENET-C Metrics: ImageNet-C summarizes performance across corruption types and severity levels with Corruption Error and mean Corruption Error (mCE), standardized using a baseline classifier’s errors.Relative mCE measures performance degradation when encountering corruptions.
  • IMAGENET-P Metrics: ImageNet-P measures prediction instability with Flip Probability, standardized Flip Rate, and mean Flip Rate (mFR) across perturbation sequences.The benchmark does not define a relative mFR and does not directly use predicted class probabilities because of calibration differences.
  • IMAGENET-P Metrics: ImageNet-P also measures top-5 prediction inconsistency using standardized Top-5 Distance and mean Top-5 Distance (mT5D).The distance is zero when the top-5 predictions in two compared outputs are identical.

5 EXPERIMENTS

The experiments find that improved architectures generalize better to corrupted inputs, while current classifiers remain unexpectedly fragile to common perturbations. Robustness improves through preprocessing, feature aggregation, increased model size, stylized training, and adversarial logit pairing.

  • Corruption and perturbation robustness: Improved architectures achieve progressively lower mean Corruption Error, while models with similar clean error rates have fairly similar corruption errors.The experiments report no large shifts in any corruption type’s Corruption Error.
  • Corruption and perturbation robustness: 15.6% of adjacent Scale-perturbation frames flip a ResNet-18’s top-1 prediction, showing that non-adversarial perturbations can fool current classifiers.VGGNets can be as robust as or more robust than ResNets on perturbed examples, despite being worse on corrupted examples.
  • Robustness enhancements: CLAHE reduces some corruption effects without worsening performance on most others, thereby improving mean Corruption Error.The paper contrasts this with an image-denoising attempt that did not provide the same benefit.
  • Robustness enhancements: DenseNets and ResNeXts have superior corruption robustness to ResNets, and larger models further improve robustness through stronger representations, redundancy, and capacity.DenseNet-121 to DenseNet-161 decreases mCE from 73.4% to 66.4% and relative mCE from 92.8% to 84.6%.
  • Robustness enhancements: ResNeXt-101 achieves 43.2% mFR and 65.9% mT5D, improving on ResNet-50’s 58.0% mFR and 78.3% mT5D.DenseNet-121 and ResNeXt-50 also improve both perturbation metrics, with 56.4% and 52.4% mFR, respectively.
  • Robustness enhancements: Stylized ImageNet training lowers a ResNet-50’s mCE from 76.7% to 69.3%, while Adversarial Logit Pairing provides significant perturbation robustness despite limited adversarial robustness.The passage describes ALP as a bypassed adversarial defense with unclear future value against adversarial examples.

6 CONCLUSION · A EXAMPLE OF IMAGENET-C SEVERITIES · B EXTRA IMAGENET-C CORRUPTIONS

The paper introduces comprehensive corruption and perturbation robustness benchmarks through ImageNet-C and ImageNet-P, finding that architectural advances produced minuscule changes in relative corruption robustness. ImageNet-C also spans severities from negligible to pulverizing and provides extra validation corruptions to reduce robustness overestimation.

  • 6 CONCLUSION: ImageNet-C and ImageNet-P provide comprehensive benchmarks for corruption and perturbation robustness.The paper presents these as new datasets enabling the benchmarks.
  • 6 CONCLUSION: Architectural advances over many years produced minuscule changes in relative corruption robustness.The conclusion argues that robustness benchmarking and improvement deserve attention as clean ImageNet accuracy nears its ceiling.
  • A EXAMPLE OF IMAGENET-C SEVERITIES: ImageNet-C corruption severities range from negligible to pulverizing, enabling comprehensive assessment of each corruption type.Figure 7 illustrates five severities for Impulse noise using a frog image.
  • B EXTRA IMAGENET-C CORRUPTIONS: Extra ImageNet-C corruption examples support model validation and sounder experimentation.The examples are presented as additional resources beyond the benchmark’s primary corruption types.
  • B EXTRA IMAGENET-C CORRUPTIONS: Researchers should avoid directly fitting ImageNet-C corruption types because this would overestimate model robustness.The paper motivates additional corruptions as a way to simplify model validation.
  • B EXTRA IMAGENET-C CORRUPTIONS: The authors provide one additional validation corruption for each noise, blur, weather, and digital category.These corruptions are available for download from the cited robustness repository.

C MORE ON THE IMAGENET-P METRICS AND SETUP

This section explains how ImageNet-P’s permutation-based metric measures deviations between top-5 prediction lists and discusses extensions for broader or more challenging perturbation robustness. It also outlines alternative ranking-weighted measures and perturbation-sequence modifications.

  • Permutation metric: The metric d′(σ) measures deviation between the top-5 predictions of two lists relative to the identity permutation.For the identity permutation, d′(σ) = 0.
  • Permutation metric: When a class falls out of the top-5, its displacement no longer accumulates because only the top-5 predictions may be shown.For σ = (1, 2, 3, 4, 6, 7, 5, 8, . . .), d′(σ) = 1.
  • Alternative measures: For all-prediction robustness, a possible measure weights rank displacements as d′(σ) = P1000 i=1 wi|wi −wσ(i)| with wi = 1/i.This weighting uses a Zipfian assumption that the first class is n times as relevant as the nth class.
  • Perturbation setup: Researchers can compare frames two steps apart to target perturbations more likely to cause unstable predictions.For nontemporal noise sequences, larger noise perturbations are provided.

D FULL CORRUPTION ROBUSTNESS RESULTS

ImageNet-C reports relative corruption robustness across 19 corruption types, with Corruption Error values normalized using AlexNet errors. Robustness varies substantially, from 56.5% for Brightness to 92.3% for Impulse Noise.

  • Normalization: Relative Corruption Error is normalized using AlexNet errors, with value 1 specified for AlexNet.The benchmark reports ImageNet-C corruption relative robustness results in Table 2.
  • Corruption results: 92.3% Impulse Noise and 89.4% Shot Noise are the highest reported corruption values.Other noise values include 88.6% for Gaussian Noise and 84.5% for Speckle Noise.
  • Corruption results: 56.5% Brightness and 60.7% JPEG are the lowest reported corruption values.Elastic Transformation is 64.6%, while Saturate is 65.8%.

E FULL PERTURBATION ROBUSTNESS RESULTS

This section reports ImageNet-P mean Flip Rate (mFR) and mean Top-5 Distance (mT5D) results across corruption types, using AlexNet errors for normalization. Tables 3 and 4 compare these perturbation robustness measures across architectures trained on clean ImageNet images.

  • ImageNet-P mFR: mFR values are reported for 14 ImageNet-P corruption and perturbation types, normalized using AlexNet errors.Gaussian Noise: 23.65%, Shot Noise: 30.06%, Motion Blur: 9.30%, Zoom Blur: 5.94%, Snow: 11.93%, Brightness: 4.89%, Translate: 11.01%, Rotate: 13.10%, Tilt: 7.05%, Scale: 23.53%, Speckle Noise: 18.65%, Gaussian Blur: 2.78%, Spatter: 5.05%, Shear: 10.66%.
  • ImageNet-P mT5D: mT5D values are reported for the same 14 corruption and perturbation types.Gaussian Noise: 4.77, Shot Noise: 5.76, Motion Blur: 1.93, Zoom Blur: 1.34, Snow: 2.42, Brightness: 1.19, Translate: 2.63, Rotate: 2.95, Tilt: 1.75, Scale: 4.48, Speckle Noise: 3.89, Gaussian Blur: 0.70, Spatter: 1.26, Shear: 2.48.
  • ImageNet-P mFR: Table 3 presents Flip Rates and mFR values for different perturbations and architectures on ImageNet-P.All models are trained on clean ImageNet images rather than ImageNet-P images.
  • ImageNet-P mT5D: Table 4 presents Top-5 Distances and mT5D values for different perturbations and architectures on ImageNet-P.The supplied passage truncates the remainder of the table caption.

F INFORMATIVE ROBUSTNESS ENHANCEMENT ATTEMPTS

The section evaluates stability training, targeted image denoising, 10-crop classification, and smaller CondenseNet models as approaches to improve robustness. Results indicate that denoising can trade noise robustness for blur sensitivity, while the tested CondenseNet was slightly less robust than comparable larger models.

  • Stability Training: Stability training minimizes cross-entropy between noisy-image and clean-image softmax distributions to improve robustness without inducing underfitting from noisy-image training.Its creators suggested additional robustness to JPEG corruptions.
  • Image Denoising: Non-local-means denoising improved noise robustness, but subtle blurs wiped away those gains across other corruptions.The experiment shows that targeted image restoration can harm overall robustness.
  • 10-Crop Classification: 10-crop classification averages predictions from four corner crops, a center crop, and their horizontal mirrors to seek more stable predictions.The method processes 10 crops through the network and averages their class-probability distributions.
  • Smaller Models: 26.3% error rate and 80.8% mCE were obtained by an off-the-shelf CondenseNet (C = G = 4), which was slightly less robust than similarly sized larger models.CondenseNet achieves its small size through sparse convolutions and pruned filter weights.

G A SEPARATE TYPE OF ROBUSTNESS

The section introduces subtype robustness as generalization to unseen subtypes sharing essential characteristics with known broad categories. Using 25 broad types from ImageNet-22K, it evaluates classifiers on subtypes categorized as seen or unseen based on ImageNet-1K membership.

  • Motivation: Subtype robustness tests whether classifiers generalize to unseen subtypes that share essential characteristics with a broader known category.The motivation contrasts this capability with reliance on superficial features, using unseen bird species as an example.
  • Subtype Robustness: The experiment manually selects 25 broad types from ImageNet-22K, an ImageNet-1K superset, with each broad type containing many subtypes.The study defines seen subtypes as those in ImageNet-1K and unseen subtypes as those from ImageNet-22K within the selected broad types.
  • Results: Unseen subtypes of known broad types are noticeably harder for ImageNet classifiers.This finding is summarized in Figure 9, which compares classifier robustness to unseen subtypes.
Loading 1903.12261v1…