Benchmarking Neural Network Robustness to Common Corruptions and Surface Variations

By Dan Hendrycks, Thomas G. Dietterich. 2018

226 citations recorded by the source corpus.

In this paper we establish rigorous benchmarks for image classifier robustness. Our first benchmark, ImageNet-C, standardizes and expands the corruption robustness topic, while showing which classifiers are preferable in safety-critical applications. Unlike recent robustness research, this benchmark evaluates performance on commonplace corruptions not worst-case adversarial corruptions. We find that there are negligible changes in relative corruption robustness from AlexNet to ResNet classifiers, and we discover ways to enhance corruption robustness. Then we propose a new dataset called Icons-50 which opens research on a new kind of robustness, surface variation robustness. With this dataset we evaluate the frailty of classifiers on new styles of known objects and unexpected instances of known classes. We also demonstrate two methods that improve surface variation robustness. Together our benchmarks may aid future work toward networks that learn fundamental class structure and also robustly generalize.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

Citations in the corpus

On Robustness and Transferability of Convolutional Neural Networks (2020, methodology): “IMAGENET-C and IMAGENET-P [27] are obtained by corrupting the IMAGENET validation set with classical corruptions, such as blur, different types of noise and compression, and further cropping the images to 224 × 224.”
Using Videos to Evaluate Image Model Robustness (2019, background): “To better evaluate the extent of model brittleness in the non-adversarial setting, the community has proposed datasets to benchmark robustness (Hendrycks & Dietterich (2018) and Temel & AlRegib (2018)).”
Deep Anomaly Detection with Outlier Exposure (2018, background): “Icons-50 is a dataset of icons and emojis (Hendrycks & Dietterich, 2018); icons from the “Number” class are removed.”
On Evaluating Adversarial Robustness (2019, background): “– Apply common corruptions and perturbations (Hendrycks & Dietterich, 2018).”
Identifying Statistical Bias in Dataset Replication (2020, background): “A step in the journey towards this goal is precisely characterizing the kinds of distribution shifts under which models fail—examples include rotations and translations of natural images Engstrom et al. (2019), or corrupted natural images (Hendrycks & Dietterich, 2019).”
Adversarial Examples Are a Natural Consequence of Test Error in Noise (2019, methodology): “Future work should make care of this distinction when comparing the performance of their methods, in particular we note that the results in (Geirhos et al., 2018; Hendrycks & Dietterich, 2018) were both evaluated on the jpeg ﬁles.”
Improving Robustness Without Sacrificing Accuracy with Patch Gaussian Augmentation (2019, methodology): “(Section 3.1) • We ﬁnd that Patch Gaussian allows us to overcome the observed trade-off (Figure 1, Section 4.1), and achieves a new state of the art in the Common Corruptions benchmark [24] on CIFAR-C and ImageNet-C.”
FAIR-Ensemble: When Fairness Naturally Emerges From Deep Ensembling (2023, methodology): “Right: CIFAR100-C test set accuracy gain ratio (same as left per-group top-k and bottom-k) of the homogeneous ensemble as the number of models being aggregated increases ( x-axis ) for varying severity of corruption levels in CIFAR100-C (recall fig.”
BREEDS: Benchmarks for Subpopulation Shift (2020, background): “Prior work in this context has focused on building benchmarks that capture distribution shifts caused by natural or adversarial input corruptions [Sze+14; FF15; FMF16; Eng+19a; For+19; HD19; Kan+19], differences in data sources [Sae+10; TE11; Kho+12; TT14; Rec+19], and changes in the frequencies of ”
Testing Robustness Against Unforeseen Adversaries (2019, methodology): “For instance, adversarial fog is created in a way similar to the synthetic fog of [20]; however, the values used in the diamond-square algorithm to generate the fog are not uniformly sampled but adversarially determined through gradient descent.”
Distilling Model Failures as Directions in Latent Space (2022, unknown): “In Appendix B, we consider other settings, such as Colored MNIST (Arjovsky et al., 2019) and ImageNet-C (Hendrycks & Dietterich, 2019).”
Negative Data Augmentation (2021, methodology): “We consider the extreme corruptions in CIFAR-10-C (Hendrycks & Dietterich, 2018) as the second set of OOD datasets.”
Affinity and Diversity: Quantifying Mechanisms of Data Augmentation (2020, methodology): “It has been used to measure robustness to corruptions of images that do not change their semantic content (Azulay & Weiss, 2018; Dodge & Karam, 2017; Ford et al., 2019; Hendrycks & Dietterich, 2018; Rosenfeld et al., 2018; Yin et al., 2019).”
Are Transformers More Robust Than CNNs? (2021, background): “…ImageNet-A [19], which are real-world images but are collected from challenging recognition scenarios ( e.g ., occlusion, fog scene); B) ImageNet-C [17], which is designed for measuring model robustness against 75 distinct common image corruptions; and C) Stylized-ImageNet [13], which creates…”
From ImageNet to Image Classification: Contextualizing Progress on Benchmarks (2020, background): “…such as: worst-case spatial transformation (e.g, rotations) (Fawzi & Frossard, 2015; Engstrom et al., 2019), common image corruptions (Hendrycks & Dietterich, 2019), adversarial texture manipulation (Geirhos et al., 2019), adversarial data collection (Barbu et al., 2019; Hendrycks et…”
The Origins and Prevalence of Texture Bias in Convolutional Neural Networks (2019, background): “Although their performance in several of these tasks approaches that of humans, recent ﬁndings show that CNNs differ in intriguing ways from human vision, indicating fundamental deﬁciencies in our understanding of these models [87, 70, 32, 23, 76, 37, 3, 44, 46, 1, 48].”