[Paper Review] Increasing the robustness of DNNs against image corruptions by playing the Game of Noise

Evgenia Rusak, Lukas Schott+5 more|arXiv (Cornell University)|Jan 16, 2020

Adversarial Robustness in Machine Learning38 citations

TL;DR

This paper proposes a noise-augmented training strategy that significantly improves deep neural network robustness against image corruptions. By training with additive Gaussian and Speckle noise, and further applying adversarial noise regularization, the method achieves state-of-the-art performance on ImageNet-C and MNIST-C benchmarks, outperforming prior defenses without architectural changes.

ABSTRACT

The human visual system is remarkably robust against a wide range of naturally occurring variations and corruptions like rain or snow. In contrast, the performance of modern image recognition models strongly degrades when evaluated on previously unseen corruptions. Here, we demonstrate that a simple but properly tuned training with additive Gaussian and Speckle noise generalizes surprisingly well to unseen corruptions, easily reaching the previous state of the art on the corruption benchmark ImageNet-C (with ResNet50) and on MNIST-C. We build on top of these strong baseline results and show that an adversarial training of the recognition model against uncorrelated worst-case noise distributions leads to an additional increase in performance. This regularization can be combined with previously proposed defense methods for further improvement.

Motivation & Objective

• To address the poor generalization of deep neural networks to unseen image corruptions such as rain, snow, and blur.
• To investigate whether noise augmentation during training can serve as a simple yet effective regularization strategy for improving robustness.
• To explore whether adversarial training against worst-case noise distributions further enhances robustness beyond standard noise augmentation.
• To evaluate the compatibility of the proposed method with existing defense techniques for additional performance gains.

Proposed method

• Training deep neural networks with additive Gaussian and Speckle noise during optimization to improve generalization to unseen corruptions.
• Applying adversarial training by optimizing for uncorrelated worst-case noise distributions that maximize the model's loss.
• Using a min-max formulation to generate noise that is worst-case for the current model, thereby strengthening robustness through adversarial regularization.
• Combining the noise-augmented and adversarial training approaches to create a strong baseline defense.
• Integrating the proposed method with existing defense techniques to evaluate synergistic improvements.
• Evaluating the final model on standard benchmarks like ImageNet-C and MNIST-C to measure robustness under diverse corruptions.

Experimental results

Research questions

• RQ1 Can training with additive Gaussian and Speckle noise significantly improve DNN robustness on unseen image corruptions?
• RQ2 Does adversarial training against worst-case noise distributions further enhance robustness beyond standard noise augmentation?
• RQ3 How does the proposed method compare to prior state-of-the-art defense methods on standard corruption benchmarks?
• RQ4 Can the proposed noise-based regularization be effectively combined with existing defense techniques for additional performance gains?

Key findings

• The proposed noise-augmented training approach achieves state-of-the-art performance on the ImageNet-C benchmark when using a ResNet50 architecture.
• The method also achieves state-of-the-art results on the MNIST-C benchmark, demonstrating strong generalization across different datasets.
• Adversarial training against worst-case noise distributions leads to an additional, measurable improvement in robustness beyond standard noise training.
• The noise-based regularization technique is compatible with and enhances existing defense methods, suggesting synergistic benefits.
• The approach achieves these results without architectural modifications, relying solely on data-level regularization.
• The method demonstrates strong generalization to previously unseen corruptions, indicating effective invariance learning through noise injection.