PaperlayerView exact revision on arXiv

Source-linked AI summary

Using Videos to Evaluate Image Model Robustness

Keren Gu, Brandon Yang, Jiquan Ngiam, Quoc Le, Jonathon Shlens

arXiv:1904.10076v3cs.CVcs.LG

TL;DR

Image models can be brittle to minute transformations that humans tolerate, motivating a broader study of robustness in natural video changes. The paper defines and evaluates natural robustness using neighboring video frames across CNN architectures, finding that more accurate models are more robust and that synthetic color distortions proxy this robustness. However, no single training technique systematically improves natural robustness across architectures.

  • Problem

    Image models are sensitive to small transformations that humans tolerate, while existing adversarial and synthetic-distortion evaluations do not fully capture transformations occurring in natural environments.

    Source: §1 · p. 2

  • Method

    The paper defines robustness as conditional accuracy on neighboring video frames and evaluates it across CNN architectures using natural transformations and synthetic distortions.

    Source: §2 · p. 2, §1 · p. 2, §3.4 · p. 3

  • Results

    More accurate models are more robust to natural transformations, and synthetic color distortions are good proxies for natural robustness.

    Source: §1 · p. 2, §5 · p. 7

  • Takeaways & Limitations

    When video frames are unavailable, synthetic color distortions provide a supported proxy for evaluating natural robustness.

    Source: §5 · p. 7

    No single training technique systematically improves natural robustness across model architectures, and the evaluation uses a common preprocessing pipeline that omits typical Inception color distortions.

    Source: §3.3 · p. 3, §5 · p. 8

Abstract

from arXiv · show

Human visual systems are robust to a wide range of image transformations that are challenging for artificial networks. We present the first study of image model robustness to the minute transformations found across video frames, which we term "natural robustness". Compared to previous studies on adversarial examples and synthetic distortions, natural robustness captures a more diverse set of common image transformations that occur in the natural environment. Our study across a dozen model architectures shows that more accurate models are more robust to natural transformations, and that robustness to synthetic color distortions is a good proxy for natural robustness. In examining brittleness in videos, we find that majority of the brittleness found in videos lies outside the typical definition of adversarial examples (99.9\%). Finally, we investigate training techniques to reduce brittleness and find that no single technique systematically improves natural robustness across twelve tested architectures.

1 INTRODUCTION

The paper introduces natural robustness to study CNN sensitivity to small, naturally occurring transformations across nearby video frames. Across its study, more accurate models are more robust, synthetic color distortions and small translations proxy natural robustness, and no single regularization method consistently improves it.

  • The paper introduces natural robustness, evaluating CNN sensitivity to transformations occurring across nearby video frames rather than only adversarial or synthetic distortions.This framework targets transformations that are diverse and closer to changes in natural environments.Source: §1 · p. 2
  • More accurate image model architectures are more robust to natural evaluations.Source: §1 · p. 2
  • Small translations and synthetic color distortions are good proxies for evaluating natural robustness.Source: §1 · p. 2
  • No single regularization technique systematically improves natural robustness across model architectures.Source: §1 · p. 2

2 ROBUSTNESS METRICS

The paper defines robustness as performance consistency between a correctly classified image and its transformed counterpart. This conditional measure applies to both synthetic distortions and natural transformations without assuming transformed images are harder to classify.

  • Natural robustness is the conditional accuracy on a neighboring frame given a correct classification on the anchor frame.The definition is agnostic to the transformation function and covers synthetic and video-derived transformations.Source: §2 · p. 2
  • Unlike relative mCE, the proposed robustness measure does not assume transformed images come from a different or harder distribution.That assumption makes relative mCE trivial for neighboring video frames from the same distribution.Source: §2 · p. 2

3 EXPERIMENTAL STUDY SETUP

The experimental setup builds a domain-matched classification and robustness benchmark from YT-BB video frames. It trains 24 baseline models across 12 architectures and evaluates natural transformations alongside ten synthetic distortion types.

3.1 DATASET

  • YT-BB provides 380K video segments across 210K videos and 24 classes, featuring objects in natural settings without editing or post-processing.Source: §3.1 · pp. 2–3

3.2 TASK

  • Domain matching is enforced by training on the YT-BB classification task, avoiding the average 27% accuracy drop observed when off-the-shelf ImageNet models are evaluated without fine-tuning.Source: §3.2 · p. 3
  • The task uses 56,209 sampled anchor frames from 23 imbalanced classes, with neighboring frames reserved for robustness evaluation rather than training.Each anchor has five preceding and five following frames sampled at 15Hz.Source: §3.2 · p. 3

3.3 MODELS

  • The study trains models from scratch and with ImageNet transfer learning across 12 architectures, producing 24 baseline models with varied task accuracy.The architectures include VGG, ResNet, MobileNet, NASNet, Inception, and Inception-ResNet variants.Source: §3.3 · p. 3
  • All models use the same random-crop-and-resize preprocessing, while translation evaluation shifts the crop without empty space or in-painting.Source: §3.3 · p. 3, §3.4 · p. 3

3.4 NATURAL TRANSFORMATIONS AND SYNTHETIC DISTORTIONS

  • Natural transformations are represented by ten neighboring frames, five before and after each anchor, sampled at 15Hz; synthetic comparisons use ten distortion types at five severity levels.Synthetic distortions include noise, blur, pixelation, JPEG quality, color changes, brightness, and small translations.Source: §3.4 · p. 3

4 RESULTS

Across 24 models and 12 architectures, nearby video frames usually produce more similar predictions, while accuracy tracks robustness to natural and selected synthetic transformations. Synthetic proxies capture natural robustness, most brittle video pairs fall outside typical adversarial neighborhoods, and no training technique helps every architecture.

4 RESULTS

  • The evaluation covers 24 fully trained models from 12 architectures on 11 transformations, each tested at five strengths, with YT-BB accuracy varying by training regime.Scratch-trained models range from 72.5% to 80.4% Top-1 accuracy, while ImageNet-finetuned counterparts range from 83.90% to 88.7%.Source: §4 · p. 4

4.1 FRAMES TEMPORALLY CLOSER IN TIME HAVE MORE SIMILAR MODEL OUTPUTS

  • Frame pairs closer in time are more likely to receive similar model predictions, although robustness to synthetic distortions decreases as distortion severity increases.The temporal result is evaluated by conditioning on the first frame being classified correctly.Source: §4.1 · p. 4, Figure 2 · p. 4

4.2 MORE ACCURATE MODELS ARE MORE ROBUST

  • More accurate architectures are more robust to both natural transformations and translation, with the result depending on evaluating small in-distribution changes.This differs from conclusions based on large train–test distribution shifts or relative mCE; the metric conditions transformed-image accuracy on correct clean-image classification.Source: Figure 3 · p. 4, §4.2 · p. 5

4.3 SYNTHETIC DISTORTIONS AS PROXIES OF NATURAL TRANSFORMATIONS

  • Translation and saturation or hue adjustments are highly correlated with natural robustness, making them practical synthetic proxies when domain-matching videos are unavailable.The proxy correlations are computed across 24 fully trained and tuned models spanning 12 architectures.Source: §4.3 · p. 5, Figure 5 · p. 6

4.4 DISTANCES BETWEEN NEIGHBORING FRAMES ARE MUCH LARGER THAN DISTANCES BETWEEN ADVERSARIAL EXAMPLES

  • Less than 0.01% of brittle 66ms frame pairs fall within the typical adversarial-example neighborhood, whose L∞ radius is ε = 16.Across 10,000 frame pairs, neighboring-frame distances had mean 213 and standard deviation 49.1, far above the typical adversarial range.Source: §4.4 · p. 6, Figure 6 · p. 6

4.5 NO SINGLE TRAINING TECHNIQUE SYSTEMATICALLY IMPROVES ROBUSTNESS

  • No single adversarial-training or regularization technique systematically improves natural robustness across all model architectures.Some techniques help particular architectures: adversarial logit pairing improves MobileNet-V1 by 0.8%, while other methods improve ResNet-V1-152 or VGG19.Source: §4.5 · pp. 6–7, Figure 7 · p. 7

5 CONCLUSION

The study finds that model accuracy tracks robustness to natural transformations, while synthetic color distortions provide a practical proxy when video frames are unavailable. Video brittleness largely falls outside standard adversarial examples, and no training technique consistently improves natural robustness across architectures.

  • More accurate models are also more robust to natural transformations, although this relationship depends strongly on the distortion type.This refines prior conclusions that accuracy and robustness are uncorrelated on average.Source: §5 · p. 7
  • Synthetic color distortions are good proxies for natural robustness when nearby video frames are unavailable.The result also supports prior use of color-based transformations as data augmentation policies for natural images.Source: §5 · p. 7
  • Brittle examples in videos rarely satisfy the typical definition of adversarial examples, so adversarial robustness does not directly measure natural robustness.Source: §5 · pp. 7–8
  • No single training technique systematically improves natural robustness across model architectures, despite early signs that adversarial-robustness training may help some architectures.Source: §5 · p. 8

A APPENDIX

The appendix contrasts neighboring video frames used for natural-robustness evaluation with synthetic distortions of increasing strength. It also reports distinctive translation robustness patterns and the expected decline in robustness as synthetic distortions intensify.

  • Neighboring frames from video segments at least 666ms long evaluate natural robustness, while synthetic distortions increase in strength from left to right.Source: Figure A.1 · p. 9
  • Models remain equally robust to one- and 16-pixel translations, with greater robustness at exactly four and eight pixels.The authors hypothesize that random crops explain the first pattern and convolutional architecture explains the second.Source: A APPENDIX · pp. 9–10
  • Increasing the strength of synthetic distortions reduces model robustness, replicating earlier findings.Source: Figure A.2 · p. 10
Loading 1904.10076v3…