[Paper Review] Benchmarking Neural Network Robustness to Common Corruptions and Perturbations

Dan Hendrycks, Thomas G. Dietterich|arXiv (Cornell University)|Mar 28, 2019

Adversarial Robustness in Machine LearningComputer Science785 citations

TL;DR

Introduces ImageNet-C and ImageNet-P benchmarks to evaluate image classifier robustness to common corruptions and perturbations, comparing architectures and suggesting robustness improvements beyond clean accuracy.

ABSTRACT

In this paper we establish rigorous benchmarks for image classifier robustness. Our first benchmark, ImageNet-C, standardizes and expands the corruption robustness topic, while showing which classifiers are preferable in safety-critical applications. Then we propose a new dataset called ImageNet-P which enables researchers to benchmark a classifier's robustness to common perturbations. Unlike recent robustness research, this benchmark evaluates performance on common corruptions and perturbations not worst-case adversarial perturbations. We find that there are negligible changes in relative corruption robustness from AlexNet classifiers to ResNet classifiers. Afterward we discover ways to enhance corruption and perturbation robustness. We even find that a bypassed adversarial defense provides substantial common perturbation robustness. Together our benchmarks may aid future work toward networks that robustly generalize.

Motivation & Objective

• Motivate the need for robustness benchmarks beyond adversarial examples.
• Define corruption and perturbation robustness in image classification.
• Create and release ImageNet-C (corruptions) and ImageNet-P (perturbations) datasets.
• Propose metrics to quantify corruption and perturbation robustness and baseline results across architectures.
• Demonstrate methods that improve robustness and reveal interactions with adversarial defenses.

Proposed method

• Define corruption robustness as the average performance across 75 corruptions at five severity levels on ImageNet validation data.
• Define perturbation robustness via perturbation sequences (ImageNet-P) and metrics like Flip Rate and Top-5 Distance.
• Introduce ImageNet-C with 15 corruption types across four categories (noise, blur, weather, digital) and five severity levels.
• Introduce ImageNet-P with temporally sequenced perturbations across selected perturbation types and evaluation metrics.
• Evaluate multiple architectures (e.g., AlexNet, SqueezeNet, VGG, ResNet, DenseNet, ResNeXt) to assess robustness trends.
• Explore robustness enhancements (CLAHE, multiscale networks, larger feature aggregation, stylization augmentation, and ALP) and report interactions with adversarial defenses.

Experimental results

Research questions

• RQ1 How do common corruptions and perturbations affect image classifier performance across architectures?
• RQ2 Do improvements in clean accuracy translate into robustness to corruptions and perturbations?
• RQ3 Can specific architectural or preprocessing changes improve corruption and perturbation robustness without sacrificing accuracy?
• RQ4 What is the relationship between adversarial defenses and robustness to common perturbations?
• RQ5 What baseline metrics best capture robustness and enable fair comparisons across models?

Key findings

• Architectural progress from AlexNet to ResNet yields limited gains in corruption robustness (mCE improvements are modest and often tied to clean accuracy).
• Perturbation robustness is underexplored and often deteriorates even for strong models; top-5 predictions can be unstable under common perturbations.
• Multiscale and feature-aggregating architectures (DenseNets, ResNeXts, Multigrid) show notable gains in corruption robustness over vanilla ResNets.
• Larger, more monolithic models with greater redundancy can improve robustness to noise and distortions beyond pure accuracy gains.
• CLAHE preprocessing modestly improves corruption robustness; stylization-based augmentation and ALP defense can also enhance robustness to common perturbations.
• Robustness improvements can come from both architectural changes and targeted preprocessing/augmentation, with certain adversarial defenses providing cross-robustness benefits.