Towards Combating Frequency Simplicity-biased Learning for Domain Generalization

Merging Contributions

Thank you for your valuable comments. We will merge the first two points as suggested.

Claim as The First

(1) [General Robustness vs. Domain Generalization(DG)] We acknowledge the correlation between general robustness studies (i.e. DFM-X) and DG, but respectfully highlight that DG involves stronger distribution shifts and semantic variances, compared to simply training on clean data and testing on its corruption subset.

(2) [Specific Focus on Frequency Shortcuts] We evaluate frequency shortcut mitigation and improved DG performance, offering a novel contribution compared to DFM-X, which uses learned frequency shortcuts for augmentation but lacks a comprehensive evaluation of frequency shortcut defending.

(3) [Further Experiments] As shown in the latter, the failure of the recommended papers (mostly work on general robustness) on single source DG, underscores the distinction between these two challenges. If general robustness were equivalent to DG, these papers would not consistently fail on the DG dataset. This suggests that general robustness and DG are indeed distinct tasks.

(4) [Further Modification] We are aware that there might be potential uncertainty, and we would replace the “first work” with “one of the pioneering works”.

Comparison with More Papers

(1) [Additional Experiments] We compare with recommended papers on PACS(DG), ImageNet-1k(general robustness), and ImageNet-10(frequency shortcut). Results in Tab. Re9,Re10,Re11 show our method's competitiveness, outperforming others on PACS and ImageNet-10 while remaining competitive on ImageNet-1k.

(2) [Reason of Dataset Scope] We didn't compare these methods and on ImageNet because our focus is on DG, with relevant methods (FACT and SADA) and established datasets. Our dataset scope aligns with established single-source DG papers[43,36,6,3].

(3) [Large-scale DG dataset] We've added results on a larger-scale DG dataset: DomainNet, showing superior performance (Tab. Re10).

Statement on Line 327-328

We are sorry for the confusion caused. We will add a performance degradation term in the ablation table for clarity so that one can easily understand the comparison with detailed numbers, as shown in Tab. Re12.

Theory Section

(1) The theory section is to bridge the gap between the theoretical proof in [24] and the frequency shortcut paper[35]. While [24] doesn't mention frequency shortcuts and [35] is purely empirical, we connect these works (Line:160-173), motivating our method. We've correctly cited [24] for the theory.

(2) We will remove the spare input-input correlation matrix, while it is represented by "the dataset statistical structure" in the paper.(i.e. Line:151 and Line:191).

(3) The matrix is calculated on the entire dataset. Yet, we can't backward on the entire dataset in one back propagation (due to GPU memory), thus we don’t directly use it and propose our in-batch technique.

Mask in AAUA

(1) We clarify that the lowest frequency is shifted to the center after FFT. Thus, frequency in coordinate (2/H, 2/W) is the lowest frequency and higher frequencies are farther from this center point.

(2) AAUA alone would shift the model's attention to partial mid-high frequencies(Line:239-240). This is based on the intuition that low frequencies dominate real-world datasets and are more likely to hide frequency shortcuts.

Comprehensive Experiments

[Missing Results] Results in Tab. 1 are drawn from the corresponding papers, the missing ones indicate they didn’t run experiments on the corresponding datasets.

[Shortcut Learning in Re-ID] The re-ID model is trained with the same loss as classification (each person has a corresponding ID), resulting in the same optimization targets. We'll provide a brief explanation of re-ID, but omit detailed analysis due to its overlap with classification.

[Frequency Shortcut Evaluation] We follow the protocol in [35] for shortcut evaluation, where the models are trained on ImageNet-10. We will further clarify it.

[Sensitivity Map in Fig. 3] (1) [Different Definition] We kindly emphasize that sensitivity maps in [43] are different from ours. They are accumulation errors on the source domain with Fourier-basis noise, while ours are derived from gradients (as shown in Appendix A.5). (2) [Uncertain Claim] [43] only provides sensitivity maps on the source domain. The claim "lower sensitivity, better generalization" remains uncertain for target domains (conclusion section of [43]). (3) [Additional Figure] Additional sensitivity maps (Fig. Re3) following [43], show that our method suppresses source domain sensitivity [43], indicating good generalization. Fig.3(a) would be cited in Sec.5.4.1

[Hardness Comparison] Adversarial is a core component of our method. Thus, the comparison is fair. Fig. Re2 shows that AAUA covers a larger range than adversarial SOTAs (ABA[3] and ALT[6]), demonstrating higher hardness.

[Initialization and Random Seeds] $d_t^{\mu}$ and others are randomly initialized with a normal distribution N(0,1). Experiments are run over three different random seeds.

"Smoothness" and Responsive Frequency

High responsive frequency means that small input changes would significantly affect the model output (i.e. adversarial attack). As this concept is closely related to the Lipschitz constant, which describes the model's smoothness, we thus use the term.

Manifold Map

(1) We assume that you are referring to Fig. 3(b). The target domains demonstrate our effectiveness in crafting augmentation domains, rather than suggesting the augmented images are close to the target ones, as they are unseen in DG. (2) Density distributions are computed with kernel density estimation based on the t-SNE results. One could do so with the Python package seaborn.kdeplot. Peak values mean more augmented images lie in that point after dimension reduction.

1.General Robustness and Domain Generalization (DG): The connection between corruption robustness and DG is discussed in the survey paper (https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=9847099), which suggests that Out-of-Distribution (OOD) robustness can be seen as a type of single-source DG problem. You mentioned that "DG considers stronger distribution shifts and semantic variances." However, strong distribution shifts are also relevant in cases of corruption and adversarial attacks. Moreover, your statement that "DG [22,43,36,6,3,46,39,37,38] and general robustness [D1,D2,D3] are mostly different research communities" lacks clear criteria for measuring the magnitude of distribution shifts or semantic variances. There doesn't seem to be solid evidence supporting the idea that DG involves stronger semantic variances. In many DG studies, the term "domain" often just refers to different environments for data collection, without necessarily indicating strong semantic variance.

2. Evaluation on Frequency Shortcut Mitigation: Given the title "Combating Frequency Simplicity-biased Learning," it is crucial to demonstrate that the proposed method effectively mitigates frequency shortcuts. Therefore, a more comprehensive evaluation is necessary to validate the benefits of your approach in this context.

3. Intuition Behind AAUA: The explanation provided for AAUA’s focus is somewhat unclear. The response states that "frequency shortcuts are more likely hidden in the dominant frequencies," and adds that "in real-world datasets, the amplitude of a natural image is often dominated by low-frequency components." However, it’s not entirely clear what is meant by "dominant frequencies"—whether it refers to those dominating amplitude or classification. Furthermore, according to paper [35], the dominant frequencies in classes that use frequency shortcuts (as seen in their DFMs) often include many mid-high frequencies, rather than just low frequencies.

More Hyper-Parameter Analysis.

(1) [Additional Results] Thank you for your valuable comments. Following your suggestion, we further provide hyper-parameter studies of the intensity of AAUA perturbations and the probability threshold $p$ for AAD in Tab. Re6 and Tab. Re7, respectively. As we don't have a clamping operation to directly restrict the noise intensity like traditional adversarial attacks [Re1] do, we thus provide an ablation on the update step size of the AAUA, as this would directly control the intensity of AAUA given static iterative steps of 5.

(2) [Additional Analysis] As shown in Tab. Re6 and Tab. Re7, the hyper-parameter setting in the main paper generally achieves the best performance. In Tab. Re6, it can be seen that both overly strong and weak perturbation intensity leads to sub-optimal performances. Because an overly strong intensity would produce augmentation domains with excessive domain-shift to learn while an overly weak intensity fails to create enough domain shift. In Tab. Re7, it be seen that a relatively higher threshold leads to better performances, because it could help filter out the frequencies with higher dependency.

Computational Overhead Analysis.

(1) [Additional Experiments] We agree that the proposed technique, involving adversarial gradient computations, would bring additional computation overhead. We conducted an efficiency study to evaluate running time per epoch and performance improvement over the baseline method (ERM). This study includes our proposed method and several related adversarial augmentation techniques [3,6,46] on the PACS dataset. The experimental results are presented in Tab. Re1. All timings were measured on a single NVIDIA A100-80G GPU with a batch size of 32. The "Photo" domain of PACS was utilized as the training domain.

(2) [Experiment Analysis] As illustrated in Tab. Re1, our method achieves the highest performance compared to the state-of-the-art adversarial augmentation techniques [3,6,46], with only a minimal increase in training time over ERM. This demonstrates the superior efficiency of our approach, which we attribute to its parameter-free nature (i.e. ABA has a Bayesian network to help generate augmentation) and the reduced number of iterative optimization steps (Ours:5 steps, AdvST: 50 steps, ALT:10 steps, ABA:14 steps).

Reason for Choosing the Specific Baselines and Comparison with Other Methods.

(1) Most of the chosen baselines are adversarial augmentation methods and Fourier augmentation methods, which are highly related to ours.

(2) Following your suggestion, we further include more diverse methods for comparison in Tab. Re8, showing comparative performances of the proposed method. Due to space limits, we show below the citations to the corresponding works in Tab. Re8.

References:

Re1: Madry, Makelov, et al. "Towards Deep Learning Models Resistant to Adversarial Attacks." ICLR (Poster) 2018

MetaCNN: Chen, Jin, et al. "Meta-causal learning for single domain generalization." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.

Pro-RandConv: Choi, Seokeon, et al. "Progressive random convolutions for single domain generalization." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.

R-XCNorm: Chuah, WeiQin, et al. "Single Domain Generalization via Normalised Cross-correlation Based Convolutions." Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 2024.

PDDOCL: Li, Deng, et al. "Prompt-Driven Dynamic Object-Centric Learning for Single Domain Generalization." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.

I appreciate the author's response; According to the disscusions among all the reviewers' and the overall concerns, I keep the rating.

Writing.

Thank you for your detailed comments. We will thoroughly revise the manuscript.

Implementation details and clarity of experiment results.

[JS loss] Yes, the JS loss is applied between predictions on augmented and clean samples

[Training domains]

(1) Kindly note that the training domains are illustrated in the captions of Tables. 5,6,7 in the appendix of the submission (Line:494,506). We follow this established protocol from previous works[43,36,6,3,46].

(2) For Digits, MNIST is used as the training domain. For PACS, each of the four domains in PACS is used as the source domain in turn, with the remaining three domains serving as target domains. This process is repeated for each domain as the source, and the model performance on the target domains is averaged to obtain the results in the table. For CIFAR-10, the training domain is CIFAR-10 itself, and CIFAR-10-C is the target domain.

[Multiple Runs] Yes, we've run the experiments three times and provided the average results.

[Hyper-parameter choosing] Following previous works[43,36,6,3,46], there is an external validation set for choosing models to evaluate the performance on the unseen target domains. We choose the hyper-parameters with a hyper-parameter study on the model generalization performances.

[In-domain performances] In the SDG scenario, we generally don't focus much on in-domain performances[37,38,22,43]. We follow your suggestion to provide in-domain performance comparisons on PACS. As shown in Tab. Re4, compared with prior related SOTAs, we generally outperform them. Despite our method only achieving similar in-domain performance against ABA[3] and ALT [6] on the “Photo” source domain, we outperform the related SOTAs across all the metrics with clear advantages.

[Explanation of Fig. 3(a)] We are sorry for the confusion caused. Fig 3(a) should be referred to in Sec. 5.4.1. In Sec. 5.4.1 we would like to justify that, given the different frequency preferences of the baseline and ours as shown between Fig. 3(a) and (b), the proposed techniques could indeed modify the model’s frequency preferences. We would further revise the manuscript and provide an illustration of Fig. 3(a) in Sec. 5.4.1.

[Baseline tSNE plots] We follow your suggestion to provide a baseline tSNE visualization in Fig. Re1, with ERM baseline and AugMix baseline. As can be seen, feature distributions in the baselines are more distinct from each other, indicating a weaker signal of generalization performance compared with our method.

Module design choices in AAUA.

(1) [Intuition] Intuitively, low-frequency components are the dominant ones in real-world datasets, which could have a higher possibility of containing frequency shortcuts. Therefore, we apply the current design of forcing AAUA to inject aggressive adversarial perturbation into low-frequency components only.

(2) [Justification] Following your suggestion, we further provide a comparison with different settings of the AAUA in terms of generalization performances. As shown in Tab. Re5, we compare the low-frequency-centered settings (Ours) with two settings from your advice. One is applying it to both low and high frequency components(All), and only on the high frequency components (Reverse). As can be seen, our setting achieves the strongest performances, with advantages over the “All” setting, and significantly outperforms the “Reverse” setting. The experiment results justify the low-frequency-centered design of AAUA.

We sincerely thank you for this valuable comment, and we will further clarify it in the revised manuscript with the intuitive motivation and ablation study justification of the AAUA design.

I thank the authors for their detailed response.

• It is nice to see that the proposed method can get better domain generalization without sacrificing ID accuracy on PACS.
• The ablation study in table Re5 is interesting. It suggests that some domains (P,C) need AAUA on low frequencies for good performance, while others don't.

However, I still have some concerns

• I am still not clear on the hyper-parameter selection. Looking at [43,46], I was unable to figure out how the hyper-parameters were selected in these works either. This is a crucial point, since it is easy to over-state the empirical results of a method by "leaking" test domains through hyper-parameters, e.g. see Gulrajani and Lopez-Paz, 2020. I would urge the authors to detail the exact mechanism behind their hyper-parameter selection method, i.e. define the space of hyperparameters searched, and specify the "external validation set" used.
• With regards to multiple run, I would like to know what the standard deviations were, and if the reported improvements in performance are significant. I stress on this point because the absolute value of improvements is low over previous methods.

Gulrajani, Ishaan, and David Lopez-Paz. "In search of lost domain generalization." arXiv preprint arXiv:2007.01434 (2020).

Parameters and Time complexity.

(1) [No Additional Parameters] We sincerely thank you for your insightful comments. Notably, as AAUA and AAD are data augmentation methods instead of neural networks, they don’t have any additional parameters. Thus, there won’t be additional parameters to train.

(2) [Additional Training Time and Efficency Study] There would be additional training time costs for generating the augmentation samples. We provide an efficiency study in terms of running time per epoch and performance improvement over baseline (ERM), including our method and related adversarial augmentation works[3,6,46] on PACS. Experiment results are shown in Tab. Re1. The time is calculated on a single NVIDIA A100-80G, with the same batch size of 32. The "Photo" domain of PACS is used as the training domain.

As can be seen, compared with the related adversarial augmentation SOTAs[3,6,46], we achieve the best performances with minimal additional training time over ERM, demonstrating the superior efficiency of our method. We reckon this is attributed to the parameter-free characteristic (i.e. ABA has an additional Bayesian network to help generate augmentation) and smaller iterative optimization steps of our method (Ours:5 steps, AdvST[46]: 50 steps, ALT[6]:10 steps, ABA[3]:14 steps).

(3) [Simple Application] To apply AAUA and AAD, one would only need to set the hyperparameters for them and input the images with corresponding labels.

Frequency Shortcut Evaluation with Traditional Augmentation methods.

(1) [Additional Experiments on Frequency Shortcut Evaluation] We follow your suggestion to conduct frequency shortcut evaluation on more augmentation methods, as shown in Tab. Re2. The experiment results demonstrate the effectiveness of our method in preventing frequency shortcut learning, while the traditional augmentation techniques fail to do so and leads to hallucinations of generalization ability improvement by applying more frequency shortcuts.

(2) [Method Differences] The core difference between our method and the recommended ones is that we conduct augmentation in the Fourier domain, while the mentioned methods focus on the spatial domain. Further, adversarial learning is also applied to enhance the augmentation samples' learning difficulty and to adaptively disrupt the learned frequency shortcuts.

Difference with Deep Frequency Filtering (CVPR'23, not open-source)

(1) [Data-centered vs Network-centered] Ours is a data-centered method, and DFF is a network-centered method. We focus on preventing frequency shortcut learning with aggressive frequency augmentation, while DFF aims to learn adaptive Fourier filters for intermediate features.

(2) [Experiment Comparisons] Following your suggestion, we provide a comparison with DFF (implemented by us, as the code of DFF is not open-source) in terms of frequency shortcut evaluation and performances on single-domain generalization in Tab. Re3. As DFF learns the filter adaptively, with no additional regularization, it eventually learns more frequency shortcuts. Further, experiment results indicate that DFF would fail in the single-source domain generalization scenario.