Elamur Research⌕
☰
home / papers / 2019 / Benchmarking Neural Network Robustness to Common Corruptions and Perturbations

Benchmarking Neural Network Robustness to Common Corruptions and Perturbations

Paper · 2019 · Dan Hendrycks and Thomas Dietterich

Summary

Most robustness research in computer vision focuses on worst-case adversarial attacks. Deployed classifiers, however, mostly face everyday degradations such as sensor noise, blur, bad weather and compression. Hendrycks and Dietterich formalize two average-case notions of robustness. Corruption robustness is accuracy on degraded inputs. Perturbation robustness is how stable predictions stay under small, non-adversarial changes. They release two test-only benchmarks built from the ImageNet validation set. ImageNet-C applies algorithmically generated corruptions at graded intensities. ImageNet-P supplies sequences of gradually altered images to measure how often predictions change. Across architectures from AlexNet to ResNet, higher clean accuracy brings almost no gain in relative corruption robustness, which leaves substantial room for progress. The authors find architectures and techniques that improve both robustness types without sacrificing accuracy. They also show that Adversarial Logit Pairing, an adversarial defense that has been circumvented, still helps noticeably against common perturbations. Intuitive remedies such as denoising, 10-crop inference or compact models do not help. The benchmarks standardize evaluation and discourage cherry-picked results, supporting reliability in safety-critical systems.

Key points

  • ImageNet-C contains 15 corruption types in four groups (noise, blur, weather, digital), each at 5 severity levels, giving 75 corruptions. Smaller editions include CIFAR-10-C, Tiny ImageNet-C and ImageNet 64×64-C, plus an Inception-sized version. Code and data are at github.com/hendrycks/robustness.
  • Robustness is reported as mCE (mean corruption error) for ImageNet-C and as flip-rate-based metrics such as mFR for ImageNet-P. Models must be trained on clean data, never on the benchmark corruptions.
  • Non-local means denoising made results worse, raising mCE from 76.7% to 82.1%, because it removed fine detail even from noise-free images.
  • Smaller models did not help. CondenseNet (C = G = 4) reached 26.3% error and 80.8% mCE. The more heavily pruned CondenseNet (C = G = 8) reached 28.9% error and 84.6% mCE. Both proved more vulnerable to corruptions than bigger networks with comparable clean accuracy.
  • An extra experiment on subtype robustness used 25 broad categories from ImageNet-22K. Classifiers recognized unseen subtypes of known categories clearly worse than seen ones.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓University of California, BerkeleyBerkeley · United States209 works · 244,782 citations🎓Oregon State UniversityCorvallis · United States11 works · 1,422 citations

 Fields, topics and concepts

📚 Shelves 5The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksComputer Vision and Pattern Recognition · 3,486 worksAgricultural and Biological Sciences · 8 worksPlant Science · 5 works

Cite

Cite as Dan Hendrycks and Thomas Dietterich. 2019. Benchmarking Neural Network Robustness to Common Corruptions and Perturbations. arXiv:1903.12261.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.48550/arxiv.1903.12261 · arXiv 1903.12261

@misc{hendrycks2019benchmarking,
  title = {{Benchmarking Neural Network Robustness to Common Corruptions and Perturbations}},
  author = {Dan Hendrycks and Thomas Dietterich},
  year = {2019},
  doi = {10.48550/arxiv.1903.12261},
  eprint = {1903.12261},
  archivePrefix = {arXiv},
  url = {https://doi.org/10.48550/arxiv.1903.12261}
}

References

63 references, 5 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Ossama Abdel-Hamid, Abdel rahman Mohamed, Hui Jiang, and Gerald Penn. Applying convolutional neural networks concepts to hybrid nn-hmm model for speech recognition. ICASSP, 2013. find
  2. Aharon Azulay and Yair Weiss. Why do deep convolutional networks generalize so poorly to small image transformations? arXiv preprint, 2018. find
  3. Osbert Bastani, Yani Ioannou, Leonidas Lampropoulos, Dimitrios Vytiniotis, Aditya Nori, and Antonio Criminisi. Measuring neural net robustness with constraints. In NIPS. 2016. find
  4. Antoni Buades and Bartomeu Coll. A non-local algorithm for image denoising. In CVPR, 2005. find
  5. Nicholas Carlini and David Wagner. Defensive distillation is not robust to adversarial examples, 2016. find
  6. Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods, 2017. find
  7. Nicholas Carlini, Guy Katz, Clark Barrett, and David L. Dill. Ground-truth adversarial examples, 2017. find
  8. Jia Deng, Wei Dong, Richard Socher, Li jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. CVPR, 2009. find
  9. Samuel Dodge and Lina Karam. Quality resilient deep neural networks, 2017a. find
  10. Samuel Dodge and Lina Karam. A study and comparison of human and deep learning recognition performance under visual distortions, 2017b. find
  11. David Donoho and Iain Johnstone. Ideal spatial adaptation by wavelet shrinkage. Biometrika, 1993. find
  12. Logan Engstrom, Andrew Ilyas, and Anish Athalye. Evaluating and understanding the robustness of adversarial logit pairing. arXiv preprint, 2018. find
  13. Ivan Evtimov, Kevin Eykholt, Earlence Fernandes, Tadayoshi Kohno, Bo Li, Atul Prakash, Amir Rahmati, and Dawn Song. Robust physical-world attacks on deep learning models, 2017. find
  14. Ruth Fong and Andrea Vedaldi. Interpretable explanations of black boxes by meaningful perturbation. ICCV, 2017. find
  15. Leon Gatys, Alexander Ecker, and Matthias Bethge. Image style transfer using convolutional neural networks. CVPR, 2016. find
  16. Robert Geirhos, David H. J. Janssen, Heiko H. Schütt, Jonas Rauber, Matthias Bethge, and Felix A. Wichmann. Comparing deep neural networks against humans: object recognition when the signal gets weaker, 2017. find
  17. Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness. ICLR, 2019. find
  18. Justin Gilmer, Ryan P. Adams, Ian Goodfellow, David Andersen, and George E. Dahl. Motivating the rules of the game for adversarial example research. arXiv preprint, 2018a. find
  19. Justin Gilmer, Luke Metz, Fartash Faghri, Samuel S. Schoenholz, Maithra Raghu, Martin Wattenberg, and Ian Goodfellow. Adversarial spheres. ICLR Workshop, 2018b. find
  20. Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. On calibration of modern neural networks. International Conference on Machine Learning, 2017. find
  21. Mark Harvilla and Richard Stern. Histogram-based subband powerwarping and spectral averaging for robust speech recognition under matched and multistyle training, 2012. find
  22. Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. CVPR, 2015.
  23. Dan Hendrycks and Kevin Gimpel. Early methods for detecting adversarial images, 2017a. find
  24. Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks. In ICLR, 2017b. find
  25. Dan Hendrycks, Mantas Mazeika, Duncan Wilson, and Kevin Gimpel. Using trusted data to train deep networks on labels corrupted by severe noise. NIPS, 2018. find
  26. Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. ICLR, 2019. find
  27. Hans-Günter Hirsch. Aurora-5 experimental framework for the performance evaluation of speech recognition in case of a hands-free speech input in noisy environments, 2007. find
  28. Hans-Günter Hirsch and David Pearce. The Aurora experimental framework for the performance evaluation of speech recognition systems under noisy conditions. ISCA ITRW ASR2000, 2000. find
  29. Hossein Hosseini, Baicen Xiao, and Radha Poovendran. Google’s cloud vision api is not robust to noise, 2017. find
  30. Gao Huang, Shichen Liu, Laurens van der Maaten, and Kilian Q Weinberger. Condensenet: An efficient DenseNet using learned group convolutions. arXiv preprint, 2017a. find
  31. Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2017b. find
  32. Gao Huang, Danlu Chen, Tianhong Li, Felix Wu, Laurens van der Maaten, and Kilian Q. Weinberger. Multi-scale dense networks for resource efficient image classification. ICLR, 2018. find
  33. Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. JMLR, 2015. find
  34. Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adversarial logit pairing. NIPS, 2018. find
  35. Tsung-Wei Ke, Michael Maire, and Stella X. Yu. Multigrid neural architectures, 2017. find
  36. Chanwoo Kim and Richard M. Stern. Power-normalized cepstral coefficients (PNCC) for robust speech recognition. IEEE/ACM Trans. Audio, Speech and Lang. Proc., 24(7):1315–1329, July 2016. ISSN 2329-9290. find
  37. Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. NIPS, 2012.
  38. Ravi Kumar and Sergei Vassilvitskii. Generalized distances between rankings, 2010. find
  39. Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. ICLR, 2017. find
  40. Jinyu Li, Li Deng, Yifan Gong, and Reinhold Haeb-Umbach. An overview of noise-robust automatic speech recognition. 2014. find
  41. Fu-Hua Liu, Richard M. Stern, Xuedong Huang, and Alex Acero. Efficient cepstral normalization for robust speech recognition. In Proc. of DARPA Speech and Natural Language Workshop, 1993. find
  42. Si Liu, Risheek Garrepalli, Thomas Dietterich, Alan Fern, and Dan Hendrycks. Open category detection with PAC guarantees. In ICML, 2018. find
  43. Jiajun Lu, Hussein Sibai, Evan Fabry, and David Forsyth. Standard detectors aren’t (currently) fooled by physical adversarial stop signs, 2017. find
  44. Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ICLR, 2018.
  45. Jan Hendrik Metzen, Tim Genewein, Volker Fischer, and Bastian Bischoff. On detecting adversarial perturbations, 2017. find
  46. Vikramjit Mitra, Horacio Franco, Richard Stern, Julien Van Hout, Luciana Ferrer, Martin Graciarena, Wen Wang, Dimitra Vergyri, Abeer Alwan, and John H.L. Hansen. Robust features in deep learning based speech recognition, 2017. find
  47. Chris Olah, Alexander Mordvintsev, and Ludwig Schubert. Feature visualization. Distill, 2017. find
  48. Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neural networks, 2017. find
  49. Stephen M. Pizer, E. Philip Amburn, John D. Austin, Robert Cromartie, Ari Geselowitz, Trey Greer, Bart Ter Haar Romeny, and John B. Zimmerman. Adaptive histogram equalization and its variations. Computer Vision, Graphics, and Image Processing, 1987. find
  50. Jonas Rauber, Wieland Brendel, and Matthias Bethge. Foolbox v0.8.0: A python toolbox to benchmark the robustness of machine learning models, 2017. find
  51. Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do cifar-10 classifiers generalize to cifar-10? arXiv preprint, 2018. find
  52. Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially robust generalization requires more data. arXiv preprint, 2018. find
  53. Lukas Schott, Jonas Rauber, Matthias Bethge, and Wieland Brendel. Towards deep learning models resistant to adversarial attacks. arXiv preprint, 2018.
  54. Jacob Steinhardt, Pang Wei Koh, and Percy Liang. Certified defenses for data poisoning attacks. NIPS, 2017. find
  55. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks, 2014.
  56. Dogancan Temel and Ghassan AlRegib. Traffic signs in the wild: Highlights from the ieee video and image processing cup 2017 student competition. find
  57. IEEE Signal Processing Magazine, 2018. find
  58. Dogancan Temel, Gukyeong Kwon, Mohit Prabhushankar, and Ghassan AlRegib. Cure-tsr: Challenging unreal and real environments for traffic sign recognition. NIPS Workshop, 2017. find
  59. Dogancan Temel, Jinsol Lee, and Ghassan AlRegib. Cure-or: Challenging unreal and real environments for object recognition. ICMLA, 2018. find
  60. Ángel de la Torre, Antonio Peinado, José Segura, José Pérez-Córdoba, Ma Carmen Benítez, and Antonio Rubio. Histogram equalization of speech representation for robust speech recognition. IEEE Signal Processing Society, 2005. find
  61. Igor Vasiljevic, Ayan Chakrabarti, and Gregory Shakhnarovich. Examining the impact of blur on recognition by convolutional networks, 2016. find
  62. Saining Xie, Ross Girshick, Piotr Dollár, Zhuowen Tu, and Kaiming He. Aggregated residual transformations for deep neural networks. CVPR, 2016. find
  63. Stephan Zheng, Yang Song, Thomas Leung, and Ian Goodfellow. Improving the robustness of deep neural networks via stability training, 2016. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/hendrycks-2019-benchmarking-neural-network-robustness-common/