A Fourier Perspective on Model Robustness in Computer Vision

Abstract

Achieving robustness to distributional shift is a longstanding and challenging goal of computer vision. Data augmentation is a commonly used approach for improving robustness, however robustness gains are typically not uniform across corruption types. Indeed increasing performance in the presence of random noise is often met with reduced performance on other corruptions such as contrast change. Understanding when and why these sorts of trade-offs occur is a crucial step towards mitigating them. Towards this end, we investigate recently observed trade-offs caused by Gaussian data augmentation and adversarial training. We find that both methods improve robustness to corruptions that are concentrated in the high frequency domain while reducing robustness to corruptions that are concentrated in the low frequency domain. This suggests that one way to mitigate these trade-offs via data augmentation is to use a more diverse set of augmentations. Towards this end we observe that AutoAugment, a recently proposed data augmentation policy optimized for clean accuracy, achieves state-of-the-art robustness on the CIFAR-10-C benchmark.

arXiv commentNeurIPS 2019

References in corpus (10)

• AutoAugment: Learning Augmentation Policies from Data
• Generalisation in humans and deep neural networks
• Do ImageNet Classifiers Generalize to ImageNet?
• Adversarial Examples Are Not Bugs, They Are Features
• Measuring the tendency of CNNs to Learn Surface Statistical Regularities
• Why do deep convolutional networks generalize so poorly to small image transformations?
• Motivating the Rules of the Game for Adversarial Example Research
• Adversarial Examples Are a Natural Consequence of Test Error in Noise
• Band-limited Training and Inference for Convolutional Neural Networks
• The Effects of JPEG and JPEG2000 Compression on Attacks using Adversarial Examples

Cited by in corpus (21)

• AugMix: A Simple Data Processing Method to Improve Robustness and Uncertainty
• Out-of-Distribution Generalization via Risk Extrapolation (REx)
• Natural Adversarial Examples
• Fighting deepfakes by detecting GAN DCT anomalies
• MEMO: Test Time Robustness via Adaptation and Augmentation
• Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbations
• Affinity and Diversity: Quantifying Mechanisms of Data Augmentation
• Adversarial Examples Improve Image Recognition
• Understanding and Mitigating the Tradeoff Between Robustness and Accuracy
• Deep Learning Assisted Data Inspection for Radio Astronomy
• On the effectiveness of adversarial training against common corruptions
• CEB Improves Model Robustness
• Causally motivated Shortcut Removal Using Auxiliary Labels
• Frequency Centric Defense Mechanisms against Adversarial Examples
• Relative stability toward diffeomorphisms indicates performance in deep nets
• Estimating the Brittleness of AI: Safety Integrity Levels and the Need for Testing Out-Of-Distribution Performance
• Defending Against Image Corruptions Through Adversarial Augmentations
• A Unified Game-Theoretic Interpretation of Adversarial Robustness
• Combining Different V1 Brain Model Variants to Improve Robustness to Image Corruptions in CNNs
• Pareto Adversarial Robustness: Balancing Spatial Robustness and Sensitivity-based Robustness
• Improving Adversarial Robustness for Free with Snapshot Ensemble