NoiseOut: Learning to Gate Improves Robustness in Deep Neural Networks

The main weakness I can see in the methodology is that this method may be over-engineering the representation noise. Deep networks has been shown to be robust to a lot of challenging cases due to their over-parameterization nature. It is likely that a well-trained model is actually robust to the noise such that those noises won't really affect the deep features if there is enough augmentation, etc. in the training process. The proposed module also requires an auxiliary loss, which may add more effort to hyperparameter tuning and thus more difficult to get actual better results. The results on ImageNet-C somehow prove this, as if there exists a strong augmentation pipeline (DeepAugment + AugMix), the proposed NoiseOut can hardly improve the results further.

More specific weaknesses and questions beyond the general idea:

1. I wonder how NoiseOut works with batch norm, does it only work with layers without batch norm?
2. Does adding manual noise in training actually improve the performance of NoiseOut? How does it compare to general data augmentation methods?
3. A justification of the effect of different lambda values is needed.
4. The architectures used in the paper are outdated. To better demonstrate the effectiveness, the authors should use some more recent architectures such as EfficientNet (or other lightweight models) and ViT (or other large models).
5. The ImageNet results show only marginal improvement. Statistical tests with more trials are needed to justify the improvement.
6. I'm not sure what the LDA analysis is trying to highlight. Is there a connection between dynamic gating policy and the model's robustness?

I have several concerns about the proposed method, mainly concerning evaluations and fairness of comparisons.

• Empirical Evaluation: The section detailing empirical evaluations appears notably insufficient. The paper lacks a comparative analysis with any SOTA robustness methods on the MNIST-C dataset. The authors mention the failure of a “plethora of state-of-the-art robustness methods” without providing detailed comparative data or analysis.

• Results on ImageNet-C: The paper does not present standalone results of the NoiseOut method on the ImageNet-C dataset. Results are only shown when the method is combined with others, yet claims of outperforming competing methods are made. This absence of direct comparison raises questions about the independent effectiveness of NoiseOut.

• Method Generalization: The evaluation of the method uses only two types of CNN architectures: a simple CNN (LeNet) for MNIST and ResNet50 for ImageNet. It remains unclear how well the proposed method generalizes across different or more complex architectures, and whether it can be scaled effectively.

• Gating Mechanism Analysis: There is a lack of comprehensive ablation studies on the gating mechanism’s behavior in response to various noise types. Insight into the failure cases, and an evaluation of how the noise sampling approach used during training addresses different noise categories (such as blurring, fog, frost, etc.) are critical. A detailed analysis, e.g. a comparison with median blur corruption strategies, would significantly strengthen the understanding and applicability of the proposed method.

• Compute and Parameter Cost Analysis: The paper does not discuss the computational and parameter costs associated with integrating the gating units. Appendix Figure 8 suggests a high optimal number of hidden nodes for NoiseOut application, potentially leading to significant computational overhead. Clarification is needed on whether this increase in parameters contributes to the notably higher performance at a 0% noise level on the MNIST dataset, compared to the baseline.

1. This paper needs a more extensive comparison to SOTA or existing methods for improving corruption robustness.
2. The discussion of the limitations and potential applications of the proposed method is ignored. For example, what is the performance when the proposed method is used in the ViT architecture?
3. The improvement of the proposed additional FIG loss term appears to be trivial, as shown in Table 1.

Despite the seemingly promising example from biological systems, I am not fully convinced by the need of gate information presented in section 3.1.

• First of all, I do not necessarily understand why we should expect the features corresponding to the corrupted images to have more negative FIG values than those of the clean images. In the integrated gradient paper, their sensitivity axiom is: If the function implemented by the deep network does not depend (mathematically) on some variable, then the attribution to that variable is always zero. So if the corrupted image contains more irrelevant features, shouldn't it have more zero IG values rather than negative IG value?
• Second, I do not think the brightness example in Figure 1 is a good demo for corruption robustness. To me, the bright seven is also a seven, and contains no less information about seven than the "clean" image. An Imagenet image may be a better motivating example.
• Third, a histogram on the FIG of a single image does not really make thee point that corrupted images really have more negative FIG values. More quantitative results are needed to support that statement.

I am not very convinced by the scalability of this method.

• The experiments on MNIST-C is mostly an ablation study and compare with several variants based on the proposed method.
• The experiments on ImageNet-C show slight improvement upon previous method (0.2%). Without an error bar, it is hard to see that this is a salient improvement.