[Paper Review] Improving Robustness Without Sacrificing Accuracy with Patch Gaussian Augmentation

Raphael Gontijo Lopes, Dong Yin+3 more|arXiv (Cornell University)|Jun 6, 2019

Adversarial Robustness in Machine LearningComputer Science50 references94 citations

TL;DR

Patch Gaussian is a simple data augmentation that adds Gaussian noise to random image patches, interpolating between Gaussian and Cutout, achieving state-of-the-art robustness on CIFAR-C and ImageNet-C while maintaining or improving clean accuracy.

ABSTRACT

Deploying machine learning systems in the real world requires both high accuracy on clean data and robustness to naturally occurring corruptions. While architectural advances have led to improved accuracy, building robust models remains challenging. Prior work has argued that there is an inherent trade-off between robustness and accuracy, which is exemplified by standard data augment techniques such as Cutout, which improves clean accuracy but not robustness, and additive Gaussian noise, which improves robustness but hurts accuracy. To overcome this trade-off, we introduce Patch Gaussian, a simple augmentation scheme that adds noise to randomly selected patches in an input image. Models trained with Patch Gaussian achieve state of the art on the CIFAR-10 and ImageNetCommon Corruptions benchmarks while also improving accuracy on clean data. We find that this augmentation leads to reduced sensitivity to high frequency noise(similar to Gaussian) while retaining the ability to take advantage of relevant high frequency information in the image (similar to Cutout). Finally, we show that Patch Gaussian can be used in conjunction with other regularization methods and data augmentation policies such as AutoAugment, and improves performance on the COCO object detection benchmark.

Motivation & Objective

• Motivate the robustness-accuracy trade-off in standard augmentations and quantify it for Cutout and Gaussian.
• Introduce Patch Gaussian to interpolate between Cutout and Gaussian and overcome the trade-off.
• Show Patch Gaussian achieves state-of-the-art robustness on CIFAR-C and ImageNet-C and is compatible with other regularizers and policies.
• Demonstrate Patch Gaussian benefits in object detection (COCO) and analyze frequency-domain effects to understand its behavior.

Proposed method

• Define Patch Gaussian as adding a W x W patch of Gaussian noise to the image, with a controllable patch size W and maximum noise σ_max.
• Vary patch size and σ_max to interpolate between Gaussian (full-image noise) and Cutout (patch-based information removal).
• Select hyper-parameters by maximizing robustness to Gaussian noise while maintaining a minimum clean accuracy Z (dataset/model dependent).
• Evaluate on CIFAR-10 and ImageNet with standard augmentations and compare to Baseline, Cutout, and Gaussian.
• Analyze interactions with other regularizers (Dropblock, label smoothing) and AutoAugment policies.
• Perform a frequency-domain analysis to understand how Patch Gaussian affects low/high-frequency information in early layers.

Experimental results

Research questions

• RQ1 Can Patch Gaussian overcome the traditional robustness-accuracy trade-off seen with Cutout and Gaussian?
• RQ2 What hyper-parameter settings (patch size, σ_max) yield the best balance of clean accuracy and robustness?
• RQ3 Does Patch Gaussian improve robustness on real-world corruption benchmarks (CIFAR-C, ImageNet-C) beyond Gaussian-only robustness?
• RQ4 Is Patch Gaussian compatible with other regularization strategies and augmentation policies, and does it transfer to object detection tasks?

Key findings

• Patch Gaussian achieves simultaneous improvements in clean accuracy and robustness on CIFAR-10 and ImageNet, overcoming the Cutout/Gaussian trade-off.
• On CIFAR-C and ImageNet-C, Patch Gaussian achieves state-of-the-art mean corruption error (mCE) and improves clean accuracy relative to baselines.
• Patch Gaussian can be combined with Dropblock and AutoAugment to further boost robustness, with some combinations yielding the best results.
• In object detection (COCO), Patch Gaussian improves mean average precision (mAP) on clean data and maintains robustness under corruption.
• Frequency analysis shows Patch Gaussian preserves useful high-frequency information in lower layers while reducing high-frequency sensitivity in later layers, combining strengths of Cutout and Gaussian.