2020

Measuring Robustness to Natural Distribution Shifts in Image Classification

Taori, Rohan, Dave, Achal, Shankar, Vaishaal et al.

Understand

We study how robust current ImageNet models are to distribution shifts arising from natural variations in datasets.

Most research on robustness focuses on synthetic image perturbations (noise, simulated weather artifacts, adversarial examples, etc.), which leaves open how robustness on synthetic distribution shift relates to distribution shift arising in real data.
Informed by an evaluation of 204 ImageNet models in 213 different test conditions, we find that there is often little to no transfer of robustness from current synthetic to natural distribution shift.
Moreover, most current techniques provide no robustness to the natural distribution shifts in our testbed.

Built on

Adversarial examples are a natural consequence of test error in noise
Original
Ford, N., Gilmer, J., Carlini, N., and Cubuk, E. D · 1901
Earlier work this paper cites.
On evaluating adversarial robustness, 2019
Original
Carlini, N., Athalye, A., Papernot, N., Brendel, W., Rauber, J., Tsipras, D., Goodfellow, I., Madry, A., and Kurakin, A · 1902
Earlier work this paper cites.
Certified adversarial robustness via randomized smoothing
Original
Cohen, J. M., Rosenfeld, E., and Kolter, J. Z · 1902
Earlier work this paper cites.
Do imagenet classifiers generalize to imagenet?
Original
Recht, B., Roelofs, R., Schmidt, L., and Shankar, V · 1902
Earlier work this paper cites.
Wasserstein adversarial examples via projected sinkhorn iterations
Original
Wong, E., Schmidt, F. R., and Kolter, J. Z · 1902
Earlier work this paper cites.
Benchmarking neural network robustness to common corruptions and perturbations
Original
Hendrycks, D. and Dietterich, T · 1903
Earlier work this paper cites.
Using videos to evaluate image model robustness
Original
Gu, K., Yang, B., Ngiam, J., Le, Q., and Shlens, J · 1904
Earlier work this paper cites.
Adversarial training for free!
Original
Shafahi, A., Najibi, M., Ghiasi, A., Xu, Z., Dickerson, J., Studer, C., Davis, L. S., Taylor, G., and Goldstein, T · 1904
Earlier work this paper cites.
Adversarial training and robustness for multiple perturbations
Original
Tramer, F. and Boneh, D · 1904
Earlier work this paper cites.
Making convolutional networks shift-invariant again
Original
Zhang, R · 1904
Earlier work this paper cites.
Unlabeled data improves adversarial robustness
Original
Carmon, Y., Raghunathan, A., Schmidt, L., Liang, P., and Duchi, J. C · 1905
Earlier work this paper cites.
Auditing ImageNet: Towards a model-driven framework for annotating demographic attributes of large-scale image datasets, 2019
Original
Dulhanty, C. and Wong, A · 1905
Earlier work this paper cites.
Transfer of adversarial robustness between perturbation types, 2019a
Original
Kang, D., Sun, Y., Brown, T., Hendrycks, D., and Steinhardt, J · 1905
Earlier work this paper cites.
Robustness to adversarial perturbations in learning from incomplete data
Original
Najafi, A., Maeda, S.-i., Koyama, M., and Miyato, T · 1905
Earlier work this paper cites.
Efficientnet: Rethinking model scaling for convolutional neural networks
Original
Tan, M. and Le, Q. V · 1905
Earlier work this paper cites.
Are labels required for improving adversarial robustness?
Original
Uesato, J., Alayrac, J.-B., Huang, P.-S., Stanforth, R., Fawzi, A., and Kohli, P · 1905
Earlier work this paper cites.
Learning robust global representations by penalizing local predictive power
Original
Wang, H., Ge, S., Xing, E. P., and Lipton, Z. C · 1905
Earlier work this paper cites.
Billion-scale semi-supervised learning for image classification, 2019
Original
Yalniz, I. Z., Jégou, H., Chen, K., Paluri, M., and Mahajan, D · 1905
Earlier work this paper cites.
Cutmix: Regularization strategy to train strong classifiers with localizable features
Original
Yun, S., Han, D., Oh, S. J., Chun, S., Choe, J., and Yoo, Y · 1905
Earlier work this paper cites.
Provably robust deep learning via adversarially trained smoothed classifiers
Original
Salman, H., Yang, G., Li, J., Zhang, P., Zhang, H., Razenshteyn, I., and Bubeck, S · 1906
Earlier work this paper cites.
Do image classifiers generalize across time?, 2019
Original
Shankar, V., Dave, A., Roelofs, R., Ramanan, D., Recht, B., and Schmidt, L · 1906
Earlier work this paper cites.
Fixing the train-test resolution discrepancy
Original
Touvron, H., Vedaldi, A., Douze, M., and Jégou, H · 1906
Earlier work this paper cites.
Invariance-inducing regularization using worst-case transformations suffices to boost accuracy and spatial robustness
Original
Yang, F., Wang, Z., and Heinze-Deml, C · 1906
Earlier work this paper cites.
A fourier perspective on model robustness in computer vision
Original
Yin, D., Lopes, R. G., Shlens, J., Cubuk, E. D., and Gilmer, J · 1906
Earlier work this paper cites.
Natural adversarial examples, 2019
Original
Hendrycks, D., Zhao, K., Basart, S., Steinhardt, J., and Song, D · 1907
Earlier work this paper cites.
Robustness properties of facebook’s resnext wsl models, 2019
Original
Orhan, A. E · 1907
Earlier work this paper cites.
Testing robustness against unforeseen adversaries, 2019b
Original
Kang, D., Sun, Y., Hendrycks, D., Brown, T., and Steinhardt, J · 1908
Earlier work this paper cites.
Randaugment: Practical automated data augmentation with a reduced search space, 2019b
Original
Cubuk, E. D., Zoph, B., Shlens, J., and Le, Q. V · 1909
Earlier work this paper cites.
Adversarial robustness against the union of multiple perturbation models, 2019
Original
Maini, P., Wong, E., and Kolter, J. Z · 1909
Earlier work this paper cites.
Distributionally robust language modeling
Original
Oren, Y., Sagawa, S., Hashimoto, T. B., and Liang, P · 1909
Earlier work this paper cites.
The visual task adaptation benchmark, 2019
Original
Zhai, X., Puigcerver, J., Kolesnikov, A., Ruyssen, P., Riquelme, C., Lucic, M., Djolonga, J., Pinto, A. S., Neumann, M., Dosovitskiy, A., Beyer, L., Bachem, O., Tschannen, M., Michalski, M., Bousquet, O., Gelly, S., and Houlsby, N · 1910
Earlier work this paper cites.
Distributionally robust neural networks for group shifts: On the importance of regularization for worst-case generalization
Original
Sagawa, S., Koh, P. W., Hashimoto, T. B., and Liang, P · 1911
Earlier work this paper cites.
Adversarial examples improve image recognition, 2019a
Original
Xie, C., Tan, M., Gong, B., Wang, J., Yuille, A., and Le, Q. V · 1911
Earlier work this paper cites.
Self-training with noisy student improves imagenet classification
Original
Xie, Q., Luong, M.-T., Hovy, E., and Le, Q. V · 1911
Earlier work this paper cites.
AugMix: A simple data processing method to improve robustness and uncertainty
Original
Hendrycks, D., Mu, N., Cubuk, E. D., Zoph, B., Gilmer, J., and Lakshminarayanan, B · 1912
Earlier work this paper cites.
Big transfer (bit): General visual representation learning, 2019
Original
Kolesnikov, A., Beyer, L., Zhai, X., Puigcerver, J., Yung, J., Gelly, S., and Houlsby, N · 1912
Earlier work this paper cites.
Human face detection in visual scenes
Rowley, H. A., Baluja, S., and Kanade, T · 1996
Earlier work this paper cites.
Example-based learning for view-based human face detection
Sung, K. . and Poggio, T · 1998
Earlier work this paper cites.

Similar

Adversarial filters of dataset biases
Original
Bras, R. L., Swayamdipta, S., Bhagavatula, C., Zellers, R., Peters, M. E., Sabharwal, A., and Choi, Y · 2002
Cited alongside, same era.
Objectnet dataset: Reanalysis and correction, 2020
Original
Borji, A · 2004
Cited alongside, same era.
The effect of natural distribution shift on question answering models
Original
Miller, J., Krauth, K., Recht, B., and Schmidt, L · 2004
Cited alongside, same era.
Histograms of oriented gradients for human detection
Dalal, N. and Triggs, B · 2005
Cited alongside, same era.
The many faces of robustness: A critical analysis of out-of-distribution generalization, 2020a
Original
Hendrycks, D., Basart, S., Mu, N., Kadavath, S., Wang, F., Dorundo, E., Desai, R., Zhu, T., Parajuli, S., Guo, M., Song, D., Steinhardt, J., and Gilmer, J · 2006
Cited alongside, same era.
On robustness and transferability of convolutional neural networks, 2020
Original
Djolonga, J., Yung, J., Tschannen, M., Romijnders, R., Beyer, L., Kolesnikov, A., Puigcerver, J., Minderer, M., D’Amour, A., Moldovan, D., Gelly, S., Houlsby, N., Zhai, X., and Lucic, M · 2007
Cited alongside, same era.
Distributionally robust losses for latent covariate mixtures, 2019
Original
Duchi, J., Hashimoto, T., and Namkoong, H · 2007
Cited alongside, same era.
In search of lost domain generalization, 2020
Original
Gulrajani, I. and Lopez-Paz, D · 2007
Cited alongside, same era.
Robustness to spurious correlations via human annotations
Original
Srivastava, M., Hashimoto, T., and Liang, P · 2007
Cited alongside, same era.
ImageNet: A large-scale hierarchical image database
Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L · 2009
Cited alongside, same era.
Dataset Shift in Machine Learning
Quionero-Candela, J., Sugiyama, M., Schwaighofer, A., and Lawrence, N. D · 2009
Cited alongside, same era.
Object detection with discriminatively trained part-based models
Felzenszwalb, P. F., Girshick, R. B., McAllester, D., and Ramanan, D · 2010
Cited alongside, same era.

Then

Youtube-boundingboxes: A large high-precision human-annotated data set for object detection in video
Real, E., Shlens, J., Mazzocchi, S., Pan, X., and Vanhoucke, V · 2017
Later among the works it cites.
No classification without representation: Assessing geodiversity issues in open data sets for the developing world, 2017
Original
Shankar, S., Halpern, Y., Breck, E., Atwood, J., Wilson, J., and Sculley, D · 2017
Later among the works it cites.
Toward robust neural machine translation for noisy input sequences
Sperber, M., Niehues, J., and Waibel, A · 2017
Later among the works it cites.
Revisiting unreasonable effectiveness of data in deep learning era
Original
Sun, C., Shrivastava, A., Singh, S., and Gupta, A · 2017
Later among the works it cites.
Inception-v4, inception-resnet and the impact of residual connections on learning
Original
Szegedy, C., Ioffe, S., Vanhoucke, V., and Alemi, A · 2017
Later among the works it cites.
mixup: Beyond empirical risk minimization
Original
Zhang, H., Cisse, M., Dauphin, Y. N., and Lopez-Paz, D · 2017
Later among the works it cites.
The Inclusive Images competition, 2018
Atwood, J., Baljekar, P., Barnes, P., Batra, A., Breck, E., Chi, P., Doshi, T., Elliott, J., Kour, G., Gaur, A., Halpern, Y., Jicha, H., Long, M., Saxena, J., Singh, R., and Sculley., D · 2018
Later among the works it cites.
Synthetic and natural noise both break neural machine translation
Original
Belinkov, Y. and Bisk, Y · 2018
Later among the works it cites.
Learning models with uniform performance via distributionally robust optimization
Original
Duchi, J. and Namkoong, H · 2018
Later among the works it cites.
Adversarial training versus weight decay, 2018
Original
Galloway, A., Tanay, T., and Taylor, G. W · 2018
Later among the works it cites.
Generalisation in humans and deep neural networks
Geirhos, R., Temme, C. R. M., Rauber, J., Schütt, H. H., Bethge, M., and Wichmann, F. A · 2018
Later among the works it cites.
Squeeze-and-excitation networks
Original
Hu, J., Shen, L., Albanie, S., Sun, G., and Wu, E · 2018
Later among the works it cites.
Progressive neural architecture search
Original
Liu, C., Zoph, B., Neumann, M., Shlens, J., Hua, W., Li, L.-J., Fei-Fei, L., Yuille, A., Huang, J., and Murphy, K · 2018
Later among the works it cites.
Shufflenet v2: Practical guidelines for efficient cnn architecture design
Original
Ma, N., Zhang, X., Zheng, H.-T., and Sun, J · 2018
Later among the works it cites.
Towards deep learning models resistant to adversarial attacks
Original
Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A · 2018
Later among the works it cites.
Exploring the limits of weakly supervised pretraining
Original
Mahajan, D. K., Girshick, R. B., Ramanathan, V., He, K., Paluri, M., Li, Y., Bharambe, A., and van der Maaten, L · 2018
Later among the works it cites.
Certified defenses against adversarial examples
Original
Raghunathan, A., Steinhardt, J., and Liang, P · 2018
Later among the works it cites.
Mobilenetv2: Inverted residuals and linear bottlenecks
Original
Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., and Chen, L.-C · 2018
Later among the works it cites.
Certifying some distributional robustness with principled adversarial training
Original
Sinha, A., Namkoong, H., Volpi, R., and Duchi, J · 2018
Later among the works it cites.
Hotpotqa: A dataset for diverse, explainable multi-hop question answering
Original
Yang, Z., Qi, P., Zhang, S., Bengio, Y., Cohen, W., Salakhutdinov, R., and Manning, C. D · 2018
Later among the works it cites.
Variable generalization performance of a deep learning model to detect pneumonia in chest radiographs: A cross-sectional study
Zech, J., Badgeley, M. A., Liu, M., Costa, A. B., Titano, J. J., and Oermann, E. K · 2018
Later among the works it cites.
SWAG: A large-scale adversarial dataset for grounded commonsense inference
Zellers, R., Bisk, Y., Schwartz, R., and Choi, Y · 2018
Later among the works it cites.
Learning transferable architectures for scalable image recognition
Original
Zoph, B., Vasudevan, V., Shlens, J., and Le, Q. V · 2018
Later among the works it cites.
Objectnet: A large-scale bias-controlled dataset for pushing the limits of object recognition models
Barbu, A., Mayo, D., Alverio, J., Luo, W., Wang, C., Gutfreund, D., Tenenbaum, J., and Katz, B · 2019
Later among the works it cites.
Excavating AI: The politics of training sets for machine learning, 2019
Crawford, K. and Paglen, T · 2019
Later among the works it cites.
BERT: Pre-training of deep bidirectional transformers for language understanding
Devlin, J., Chang, M.-W., Lee, K., and Toutanova, K · 2019
Later among the works it cites.
Variance-based regularization with convex objectives
Original
Duchi, J. and Namkoong, H · 2019
Later among the works it cites.
ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness
Original
Geirhos, R., Rubisch, P., Michaelis, C., Bethge, M., Wichmann, F. A., and Brendel, W · 2019
Later among the works it cites.
Natural questions: a benchmark for question answering research
Original
Kwiatkowski, T., Palomaki, J., Redfield, O., Collins, M., Parikh, A., Alberti, C., Epstein, D., Polosukhin, I., Devlin, J., Lee, K., et al · 2019
Later among the works it cites.
Model cards for model reporting
Original
Mitchell, M., Wu, S., Zaldivar, A., Barnes, P., Vasserman, L., Hutchinson, B., Spitzer, E., Raji, I. D., and Gebru, T · 2019
Later among the works it cites.
Mnasnet: Platform-aware neural architecture search for mobile
Original
Tan, M., Chen, B., Pang, R., Vasudevan, V., Sandler, M., Howard, A., and Le, Q. V · 2019
Later among the works it cites.
When robustness doesn’t promote robustness: Synthetic vs. natural distribution shifts on imagenet, 2019
Taori, R., Dave, A., Shankar, V., Carlini, N., Recht, B., and Schmidt, L · 2019
Later among the works it cites.
Tencent ml-images: A large-scale multi-label image database for visual representation learning
Wu, B., Chen, W., Fan, Y., Zhang, Y., Hou, J., Liu, J., and Zhang, T · 2019
Later among the works it cites.
Theoretically principled trade-off between robustness and accuracy
Zhang, H., Yu, Y., Jiao, J., Xing, E., Ghaoui, L. E., and Jordan, M. I · 2019
Later among the works it cites.
A human-centered evaluation of a deep learning system deployed in clinics for the detection of diabetic retinopathy
Beede, E., Baylor, E., Hersh, F., Iurchenko, A., Wilcox, L., Ruamviboonsuk, P., and Vardoulakis, L. M · 2020
Closest in time.
The open images dataset v4
Original
Kuznetsova, A., Rom, H., Alldrin, N., Uijlings, J., Krasin, I., Pont-Tuset, J., Kamali, S., Popov, S., Malloci, M., Kolesnikov, A., and et al · 2020
Closest in time.
Evaluating machine accuracy on imagenet
Shankar, V., Roelofs, R., Mania, H., Fang, A., Recht, B., and Schmidt, L · 2020
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…