Improving robustness to corruptions with multiplicative weight perturbations

1. "There could be a related work [1] focusing on (adversarial) corruptions, where it also approaches the model robustness problem from model weights perspective...."

Thank you for the suggestion. This is indeed an interesting related paper which proposes a score called CRoZe that can quickly evaluate the robustness to input perturbations of an architecture using only one batch of training data for zero-shot neural architecture search (NAS). We think that the multiplicative weight perturbations (MWPs) of DAMP can also be used inside the calculation of the CRoZe score to evaluate the robustness of an architecture, which could be a good future research direction. We will include this mention of [1] in the Related Works section of our revised paper.

2. "What is the effectiveness of DAMP on deeper/modern neural networks, such as Resnet-152 EfficientNet, ConvNext, MaxViT?"

In our paper, we have demonstrated the effectiveness of DAMP on ResNet50 and ViT-S16 on ImageNet. We now further provide new results with ViT-B16 in our global response (Table D in the PDF). These results together demonstrate that DAMP is capable of improving the robustness of deep and modern neural networks. Furthermore, as modern networks get larger and have bigger learning capacity, we believe that they could benefit from the additional implicit data augmentations/perturbations induced by the random multiplicative weight perturbations of DAMP, even more so than their smaller counterparts since they have the capacity to learn to output the correct predictions even when the inputs are corrupted by these implicit perturbations.

3. "What is the effectiveness of DAMP on other corruption (such as Stylised ImageNet, ImageNet-D), natural corruption (such as ImageNet-A, ImageNet-Sketch), and adversarial corruption?"

Thank you for your suggestions. We provide new results in our global response (Table B and D in the PDF) where we evaluate models trained with DAMP and baseline methods on ImageNet-D [2], ImageNet-A [3], ImageNet-Sketch [4], ImageNet-Cartoon [5], ImageNet-Drawing [5], and adversarial corruptions generated by FGSM [6], demonstrating that models trained with DAMP are more robust to various types of input perturbations than the baseline training methods.

4. "What is the advantage of DAMP over SAM/ASAM?"

As stated in our paper, the main advantage of DAMP over SAM/ASAM is that it requires only one forward-backward pass per training iteration, while SAM/ASAM requires two consecutive forward-backward passes per iteration. Therefore, given the same number of iterations, SAM/ASAM takes twice as long to finish training than DAMP. Furthermore, our experimental results show that on corrupted inputs, DAMP outperforms SAM in the majority of cases and is competitive with ASAM. Finally, our new results in the global response (Table D in the attached PDF) indicate that training a ViT-B16 (86M params) with DAMP leads to better accuracy than training ViT-S16 (22M params) with SAM/ASAM, yet both settings take roughly the same amount of time. Thus given the same training budget, it is better to train a large model with DAMP than to train a smaller model with SAM/ASAM.

[1] Ha et al. "Generalizable lightweight proxy for robust NAS against diverse perturbations." NeurIPS 2024.

[2] Zhang et al. "ImageNet-D: Benchmarking Neural Network Robustness on Diffusion Synthetic Object". CVPR 2024.

[3] Hendrycks et al. "Natural Adversarial Examples". CVPR 2021.

[4] Wang et al. "Learning Robust Global Representations by Penalizing Local Predictive Power". NeurIPS 2019.

[5] Salvador et al. "ImageNet-Cartoon and ImageNet-Drawing: two domain shift datasets for ImageNet". ICML 2022 Shift Happens Workshop.

[6] Goodfellow et al. "Explaining and Harnessing Adversarial Examples". arXiv preprint arXiv:1412.6572, 2014.

Thank you for the comments and for the increased confidence in the proposed method.

We note that there are cases where DAMP does not need more training iterations to surpass ASAM/SAM. For instance, in the ResNet50 / ImageNet experiments (Table 1 in the paper), we use 90 epochs for all training methods, yet DAMP is able to perform competitively with ASAM and surpass SAM.

Furthermore, we show in Table D of our global response that training ViT-S16 / ImageNet using 500 epochs of DAMP (which took 111hrs) outperforms 300 epochs of ASAM/SAM (which took 123hrs). Therefore, even in the cases where DAMP requires more iterations to outperform ASAM/SAM, it still ends up requiring less overall runtime than ASAM/SAM.

1. "...It seems like DAMP is mostly an approximation of ASAM which allows faster training (and that is great) but at the same time, it is not as effective as ASAM. So effectively, this method introduces a trade-off between performance (accuracy) and training time..."

There is a misunderstanding here. DAMP is actually not an approximation of ASAM and can even outperform ASAM. The objective function of DAMP (Eq. 16 in our paper) is: $\mathcal{L}\_{\mathrm{DAMP}}(\boldsymbol{\omega}; \mathcal{D}) = \mathbb{E}\_{\boldsymbol{\xi}\sim\mathcal{N}(\boldsymbol{1},\sigma^2\mathbf{I})}\left[\mathcal{L}(\boldsymbol{\omega}\circ\boldsymbol{\xi}; \mathcal{D})\right] + \frac{\lambda}{2}||\boldsymbol{\omega}||\_2^2$ while the objective function of ASAM (Eq. 21 in our paper) can be written as: $\mathcal{L}\_{\mathrm{ASAM}}(\boldsymbol{\omega};\mathcal{D})=\max\_{||\boldsymbol{\xi}||\_2 \leq \rho}\mathcal{L}(\boldsymbol{\omega}\circ(1+\boldsymbol{\xi});\mathcal{D})+\frac{\lambda}{2}||\boldsymbol{\omega}||\_2^2$ where $\boldsymbol{\omega}$ is the model's parameters, $\mathcal{D}$ is the training data, $\mathcal{L}$ is the loss function such as cross-entropy, and $\circ$ denotes the Hadamard product. Thus DAMP minimizes the expected loss under multiplicative weight perturbations (MWPs), while ASAM minimizes the loss under the worse-case MWP. This is a crucial distinction, since minimizing the expectation allows us to devise an efficient version of DAMP (Algorithm 1 in the paper), while ASAM needs two forward-backward passes for each iteration (the first one to approximate the worse-case MWP, the second one is to minimize the loss under such MWP). Thus given the same number of training iterations, ASAM takes twice as long to train as DAMP. In Table D of the PDF attached to our global response, training a ViT-B16 (86M params) with DAMP leads to better accuracy than training ViT-S16 (22M params) with ASAM, yet both settings take roughly the same amount of time. Thus given the same training budget, it is better to train a large model with DAMP than to train a smaller model with ASAM.

2. "If multiplicative weight perturbations are connected to data augmentation then how does DAMP rank against them?..."

"Additionally, it would be great to understand if DAMP is compatible with augmentations..."

Modern data augmentations (DAs) (such as MixUp, RandAugment) are cheap and contain informative prior knowledge, and thus they could greatly improve performance of a model. However, they are specific to computer vision and not applicable to other domains like natural language processing. On the other hand, multiplicative weight perturbations (MWPs) are less informative than DAs but they are domain-agnostic and thus can be applied to a wide range of tasks. For instance, DAMP improves the test accuracy of Mistral-7B finetuned by LoRA on the MedMCQA dataset from 49.05% to 50.25%, as shown in Table A in the PDF attached to the global response. Furthermore, since MWPs operate on the weight space while DAs operate on the input space, they can be combined together to further enhance performance, as shown in Table D of the global response combining DAMP with MixUp and RandAugment to train ViT-S16 and ViT-B16.

3. "the theory in Eq.1ff assumes bias-free MLP architectures without non-linearities which obviously does not scale to modern architectures."

There is a misunderstanding here. In our theoretical analysis, we use a bias-free MLP architectures with non-linear activations, as shown in Eq. 1-3 in our paper. It would be pointless for us to analyze an MLP without non-linear activations since such model is equivalent to a simple one-layer linear model. We note that other papers (e.g. [1, 2]) also assume a bias-free MLP for their analyses. Finally, we want to note that Theorem 1 in our paper motivates the design of the DAMP algorithm which, as we demonstrate through our large-scale ImageNet experiments, does scale well to modern architectures.

4. "I agree that random perturbations introduce almost no overhead, but you shouldn't state "we found that ... had similar training times" in a scientific paper without backing it up with hard numbers."

"It would be great to add averages over all severities in Tab. 1 and 2."

Thank you for your suggestions. We now added the runtimes and the results averaged over severities for each setting in our global response (Table B and D), and will include them in the revised paper.

5. "A simple way to kill all my concerns is to show performance on non-vision tasks (since DAMP is in theory data-agnostic). In that case, it would exceed the value of domain-specific augmentations. This would greatly enhance this paper but of course, I do not expect this from a rebuttal."

Thank you for your suggestions. We now added results of using DAMP with LoRA to finetune a Mistral-7B on the MedMCQA dataset in our global response (Table A), demonstrating that it improves the test accuracy from 49.05% to 50.25%.

[1] Dusenberry et al. "Efficient and scalable Bayesian neural nets with rank-1 factors." ICML, 2020.

[2] Andriushchenko et al. "Sharpness-Aware Minimization Leads to Low-Rank Features". NeurIPS, 2023.

Thank you for the comments. We will definitely include these new results in the revised version of the paper.

1. "It would be beneficial to see how the method performs with different hyperparameter values, as the reported numbers for different metrics are close to each other."

Thank you for your suggestion. We provide Table C in the PDF file attached to our global response showing the accuracy of ViT-S16 on ImageNet under different variances of the random multiplicative weight perturbations of DAMP. Specifically, as we increase the perturbation variance, the accuracy improves up to a maximum value then degrades afterwards. We will include this table in the revised paper.

2.  "Assumption 2 is not explained very well and could benefit from a clearer, more detailed explanation"

Assumption 2 states that the gradient with respect to the input $\mathbf{x}$ of the loss function $\ell(\boldsymbol{\omega}, \mathbf{x}, y)$ is Lipschitz continuous. This simply means that there exists a constant $C > 0$ such that for all $\mathbf{x}\_1, \mathbf{x}\_2$, we have:
$||\nabla\_{\mathbf{x}}\ell(\boldsymbol{\omega},\mathbf{x}\_1,y)-\nabla\_{\mathbf{x}}\ell(\boldsymbol{\omega},\mathbf{x}\_2,y)||\_2^2\leq C||\mathbf{x}\_1-\mathbf{x}\_2||\_2^2$ We will clarify assumption 2 as shown here in the revised paper.

3. "While DAMP works well for small models and datasets, it would be interesting to see the results with larger models and datasets, as it seems to show some instability in results on these larger models and datasets."

Perhaps there is a misunderstanding here. We have shown that DAMP works well on both ResNet50 and ViT-S16 on ImageNet in our paper, and we experienced no instability when using DAMP to train these models. In our new experiments (see Table D in the PDF file of our global response), we use DAMP to train a ViT-B16, a larger version of ViT-S16, showing that DAMP also leads to improved performance in this case. Thus we believe that DAMP is perfectly capable of training large models on large datasets.

4. "Why is DAMP trained for 200 epochs compared to other methods trained for 100 epochs in Table 2?"

In Table 2, we compare models trained with DAMP and AdamW for 200 epochs to models trained with SAM and ASAM for 100 epochs. This is because SAM and ASAM require two forward-backward passes per training iteration, while DAMP and AdamW require only one forward-backward pass per iteration. Therefore, the time it takes to run 200 epochs of DAMP is roughly the same as 100 epochs of SAM/ASAM. We have already emphasized this in the paper but will add a further comment. We also have included the runtime of these experiments in Table B and Table D of the PDF attached to our global response.

5. "How does the model perform when tested on other types of distribution shifts beyond those included in the corruption benchmarks?"

We provide new results in Table B and Table D in the PDF of our global response where we evaluate models trained with DAMP and baseline methods on ImageNet-D [1], ImageNet-A [2], ImageNet-Sketch [3], ImageNet-Cartoon [4], ImageNet-Drawing [4], and adversarial corruptions generated by FGSM [5], demonstrating that models trained with DAMP are more robust to various types of input perturbations than the baseline training methods.

6. "How do the methods perform without basic Inception-style preprocessing?"

We provide new results in Table D in the PDF of our global response where we train ViT-S16 and ViT-B16 with MixUp and RandAugment, showing that DAMP is able to work in tandem with these modern data augmentations to further enhance model performance.

7. "The results could be better explained, particularly why the accuracy on clean images and lower severity corruptions is lower than the ASAM method in larger-scale experiments for ResNet/ImageNet."

As we explain in Section 3 of the paper, ASAM actually minimizes the training loss under adversarial multiplicative weight perturbations (MWPs), as shown by the inner maximization over the MWPs $\boldsymbol{\xi}$ in its objective function (Eq. 21 in the paper): $\mathcal{L}\_{\mathrm{ASAM}}(\boldsymbol{\omega};\mathcal{D})=\max\_{||\boldsymbol{\xi}||\_2 \leq \rho}\mathcal{L}(\boldsymbol{\omega}\circ(1+\boldsymbol{\xi});\mathcal{D})+\frac{\lambda}{2}||\boldsymbol{\omega}||\_2^2$ and thus it is also able to produce robust models. This is why Table 1 in the paper (ResNet50 / ImageNet) shows that ASAM is able to outperform DAMP on clean images and on corruption severity levels 1, 2 and 3 of ImageNet-C. However, Table 1 also shows that DAMP outperforms ASAM on severity levels  4 and 5 of ImageNet-C as well as on all 5 severity levels of ImageNet-$\bar{\mathrm{C}}$. Furthermore, as we have stated above, the training time of DAMP is half that of ASAM, and since we use 90 epochs for all experiments in Table 1, this means that DAMP is able to outperform ASAM on the majority of test sets while being more efficient. We will add a further pointer to these for clarity.

[1] Zhang et al. "ImageNet-D: Benchmarking Neural Network Robustness on Diffusion Synthetic Object". CVPR 2024.

[2] Hendrycks et al. "Natural Adversarial Examples". CVPR 2021.

[3] Wang et al. "Learning Robust Global Representations by Penalizing Local Predictive Power". NeurIPS 2019.

[4] Salvador et al. "ImageNet-Cartoon and ImageNet-Drawing: two domain shift datasets for ImageNet". ICML 2022 Shift Happens Workshop.

[5] Goodfellow et al. "Explaining and Harnessing Adversarial Examples". arXiv preprint arXiv:1412.6572, 2014.

1. On the novelty of this work and its connections to previous works:

The novel contributions are:

1. Showing the theoretical connection between perturbations in the input space and perturbations in the weight space, in particular, that one can simulate perturbations in the input space via multiplicative weight perturbations.
2. From this connection, we propose a new method, Data Augmentation via Multiplicative Perturbations (DAMP), which multiplies each individual weight of a network with its own Gaussian random variables during training.
3. We provide a new theoretical interpretation of Adaptive Sharpness Aware Minimization (ASAM) [3], a variant of SAM [2], that ASAM actually minimizes the loss under adversarial multiplicative weight perturbation as opposed to SAM which minimizes the loss under adversarial additive perturbations.
4. We show that DAMP works well with modern architectures as demonstrated by our large-scale experiments on training ResNet50 and ViT-S16 on ImageNet.

The differences between DAMP and previous works like Dropout and its variants are:

1. Dropout multiplies all the weights connecting to the same input node with a random Bernoulli variable, which has the disadvantage that it reduces the update frequency of the weights during training (since dropped weights receive no gradient update from backpropagation). On the other hand, DAMP multiplies each individual weight with its own random Gaussian variable, which perturbs the weights while allowing them to receive non-zero gradients at each iteration.
2. Dropout focuses on improving generalization on clean test data, while DAMP focuses on improving generalization on corrupted test data.
3. The work in [1] multiplies all the weights connecting to the same input node with a Gaussian random variable. Their motivation is to introduce Rank-1 BNNs, an efficient Bayesian neural network (BNN), and they attribute the improvements on corrupted data to the epistemic uncertainty of the Rank-1 BNNs. Our work demonstrates that multiplicative weight perturbations are actually the main reason for the improved robustness.

While the concept of weight perturbations is not new, to the best of our knowledge, no earlier work specifically studies this technique to robustify models to input corruptions. Here we shed light on a simple algorithm that could be applied to any training setting to enhance model robustness with zero additional cost, and we believe that this new knowledge is beneficial to the machine learning community.

2. "The theoretical foundation is weak. The theory section consists of trivial analysis by adding constrained corruption to inputs, which is not significantly related to this work."

We appreciate your perspective on our theoretical analysis. However, we believe that our analysis, while simple, provides a direct link between input corruptions and multiplicative weight perturbations. Specifically, Theorem 1 proves that the training loss under input corruptions is upper bounded by the training loss under multiplicative weight perturbations plus an $L2$-regularization term. This connection serves as the foundation for our DAMP algorithm, offering a clear rationale for its design and effectiveness. We also note that many analyses, when presented in a clear and concise manner, may seem obvious in hindsight.

3. Comparing DAMP to modern augmentation techniques:

The modern augmentation techniques directly modify the inputs in the input space, while DAMP perturbs the weights in the weight space to simulate input corruptions. As they operate on two different spaces, DAMP and the augmentation techniques can be combined together to further enhance corruption robustness. We demonstrate this idea with new experiments training the ViT-S16 and ViT-B16 on ImageNet with MixUp and RandAugment (Table D in the PDF of our global response), showing that DAMP works in tandem with these augmentations to boost robustness.

DAMP is simpler than these augmentation techniques since it is domain-agnostic and can be applied to any tasks and any neural network architectures. This is actually an advantage as demonstrated through our new experiments finetuning Mistral-7B on MedMCQA dataset using DAMP and LoRA (Table A in the PDF of our global response). By applying DAMP on the low-rank weights, we improve the test accuracy on the MedMCQA from 49.05% to 50.25%.

4. "DAMP is evidently more unstable, particularly in large-scale training, due to the stochasticity introduced during training..."

We respectfully disagree. DAMP multiplies each individual weight with its own Gaussian random variable with distribution $\mathcal{N}(1, \sigma^2)$, and thus we can control the strength of the perturbations via the variance $\sigma^2$. Of course, if we set $\sigma^2$ too high then the training cannot converge due to high stochasticity, while setting $\sigma^2$ too low reduces the effectiveness of the perturbations. In this sense, our method is no different than other regularization techniques, as setting the dropout rate or the weight decay coefficient too high also prevents convergence. In our experiments, we never observe any instability when the variance is properly tuned using a validation set, and we were able to successfully train ResNet50, ViT-S16, and ViT-B16 on ImageNet, as well as finetuning Mistral-7B. Finally, we note that earlier studies such as [4] showed that introducing stochasticity in neural network training acts as regularization which improves generalization.

[1] Dusenberry et al. "Efficient and scalable Bayesian neural nets with rank-1 factors." ICML, 2020.

[2] Foret et al. “Sharpness-Aware Minimization for Efficiently Improving Generalization”. ICLR, 2021

[3] Kwon et al. “ASAM: Adaptive Sharpness-Aware Minimization for Scale-Invariant Learning of Deep Neural Networks”. ICML, 2022

[4] Keskar et al. “On Large-Batch Training for Deep Learning: Generalization Gap and Sharp Minima”, ICLR 2017.

I appreciate the authors for their prompt response. It appears that DMAP is more similar to variational DropConnect [1], as it involves multiplying random variables with weights rather than activations. This approach also seems akin to variational inference in Bayesian Neural Networks (BNNs), where independent Gaussian variables are multiplied or added to weights in each forward process in practice, as seen in recent methods like SSVI [2].

I would be inclined to support acceptance if the authors could clarify these 2 points further in future revisions. This work seems to provide valuable guidance and aims to scale these techniques to larger models and datasets, with a specific benefit in robustness.

1. Rimella, Lorenzo, and Nick Whiteley. "Dynamic Bayesian Neural Networks." arXiv preprint arXiv:2004.06963 (2020).

2. Li, Junbo, et al. "Training Bayesian Neural Networks with Sparse Subspace Variational Inference." arXiv preprint arXiv:2402.11025 (2024).