DRoP: Distributionally Robust Data Pruning

Q1. The reason why pruning with DRoP seems to be less stable with a sudden average accuracy drop at density 0.3 on Waterbirds (Figure 9) is related to the strategy of reporting the average accuracy on Waterbirds as introduced by Sagawa et al. (2020). Here, instead of computing the proportion of correctly classified samples in the test set, we sum group accuracies weighted by the original unequal proportions found in the training dataset. As expected, DRoP skews the dataset composition towards minority groups that contribute much less to the average accuracy (computed in this way) than the originally overrepresented groups, which start losing in performance due to heavy pruning. Please refer to point 5 of the General Response and the corresponding revisions in the paper.

We hope that we addressed all your concerns, and that you are satisfied with our responses and changes. Please consider raising your mark and recommending our paper for acceptance.

References
[1] Sagawa, S., et al. "Distributionally Robust Neural Networks". ICLR 2020.
[2] Paul, M., et al. "Deep Learning on a Data Diet: Finding Important Examples Early in Training". NeurIPS 2021.
[3] Good, A., et al. "Recall Distortion in Neural Network Pruning and the Undecayed Pruning Algorithm". NeurIPS 2022.
[4] Ma, X., et al. "On the Tradeoff Between Robustness and Fairness". NeurIPS 2022.
[5] Ayed, F., Hayou, S. "Data Pruning and Neural Scaling Laws: Fundamental Limitations of Score-based Algorithms". TMLR 2023.
[6] Zhao, B., Bilen, H. "Dataset Condensation with Distribution Matching". ICCV 2023.
[7] Feng, Y., et al. "Embarrassingly Simple Dataset Distillation". ICLR 2024.

We thank the reviewer for their time and feedback. We would like to address your concerns below (please note that we break our response into two parts due to space constraints)

W1. While our abstract unequivocally specifies the type of pruning we are concerned with, we are happy to change the title to "DRoP: Distributionally Robust Data Pruning" to avoid any confusion, as per your suggestion.

W2. We respectfully disagree that the problem of classification bias is not discussed and defined in our paper. In paragraph "Robustness and Evaluation Metrics" (Section 2, page 3), we first introduce and overview distributional robustness, and then define classification bias as a special case of that more general framework in lines 136-138. Further, in lines 138-143, we refer to existing literature to explain what methods and datasets are prone to classification bias (e.g., long-tailed datasets, model pruning, and adversarial training). To make this point clearer in the text, we made a few changes to the structure of our paper (see points 2 and 3 of the General Response).

W3. It is true that we predominantly focus on the problem of classification bias, as we claim in Section 1, imply throughout the text, and explicitly state in lines 136-138 of Section 2 and in line 535 of Limitations. However, as we argue in Section 2 (lines 120-137), classification bias is a special case of distributional robustness (DRO). We state in lines 120-121 that "Distributional robustness in machine learning concerns the issue of non-uniform accuracy over the data distribution (Sagawa et al., 2020)", and, after a comprehensive discussion of topics and prior art of DRO, connect it to classification bias in lines 136-138: "The focus of our study is a special case of group robustness, classification bias, where groups are directly defined by class attributions". Our contributions are clearly equally applicable more generally across the domain of DRO, and we even evaluate DRoP on Waterbirds (see the last paragraph of Section 5)----a standard benchmark for group-wise robustness. Therefore, we argue that our paper and contributions are correctly framed around distributional robustness. Finally, we would like to point out that the suggested "class-wise fairness" is not an appropriate scope for our paper as "fairness" is a separate sub-field within DRO that focuses on demographic group attributes and optimizes for different metrics such as equal opportunity and equalized odds (see lines 126-128). We recognize, however, that the literature on DRO and related topics is extensive and interwoven, and we welcome your concrete suggestions on how we might better delineate these distinctions in our work.

W4. We agree that expanding the set of architectures to even larger models like ViT could benefit the empirical section of the paper and strengthen our conclusions. Unfortunately, it is not feasible to conduct more experiments with these models on large-scale datasets they deserve in the timeframe of the rebuttal period. Thus, we are currently repeating some of our empirical work with ResNet-101 on CIFAR-100, and we will include these results should they be ready in time. Still, we would like to argue that the reported benchmarks cover a wide range of scales (CIFAR-10 to ImageNet), proving our empirics to be well on par or stronger compared to many reputed papers recently published in this field (Paul et al., 2021; Good et al., 2022; Ma et al., 2022; Ayed & Hayou, 2023; Zhao & Bilen, 2023; Feng et al., 2024). To further strenghten our empirical evidence, we incorporate imbalanced datasets (Figure 8), group-wise robustness benchmarks (Figure 9), as well as an alternative specialized optimization procedure from prior art (Figure 7). Overall, we believe that our empirical work is strong and consistent, illustating our conclusions and the effectiveness of our method. We would highly appreciate it if you could specify the reasons behind your low mark in the "evaluation" rubric, and consider improving your score. If you would like us to conduct any additional experiments that are reasonable within the rebuttal period, kindly let us know, and we will try our best to accommodate your suggestions.

Thank you for such a significant increase in the rating; we are happy to see that our responses resolved your concerns. We agree with your remark regarding higher robustness of large models. We updated the manuscript with new experiments using Wide-ResNet-101 (125M parameters) on CIFAR-100 (Figure 13 and the last paragraph of Appendix D), and we believe that the results are favorable to our method.

We thank the reviewer for your strong eveluation of our work and thoughtful comments. We respond to them below.

1. We agree with your suggestion, and we revised th manuscript to include a separate "Related Work" section (see point 2 of the General Response).

2. We hope that the discussion of prior art in data pruning and distributional robustness is now easier to identify with a standalone "Related Works" section that we added.

3. We agree that we include only limited cross-evaluation with existing methods in distributional robustness and learning on long-tailed datasets primarily because we attribute our contributions to data pruning; we state this explicitly in the Limitations paragraph on page 10. However, we added many more baseline methods to Figure 9 (Waterbirds)--please see point 4 of the General Response as well as the revised manuscript.

We thank you once again for your encouraging feedback, and we hope that you will find all your suggestions well addressed in the revision.

2. We added a table reporting mean values for the majority of our experiemnts (see Table 2 in Appendix D). For each dataset and density, DRoP achieves the best worst-class accuracy across all tested baselines.

3. For each class, Figure 6 (right) plots its validation recall achieved by the preliminary model fully trained on the entire dataset against its density in the DRoP-pruned dataset, for a variety of overall dataset densities that are color-encoded. Intuitively, the more difficult a class is as measured by the preliminary model (smaller ordinate), the higher its density should be in a robust pruned dataset (larger abscissa), which is a central idea behind DRoP. This "rule" is suggested by our theoretical analysis in Section 4 where we substitute a provable optimal ratio of class standard deviations for the ratio of class errors achieved by the average risk minimizer (see Figure 4 and the discussion in the last paragraph of Section 4). Thus, a more pronounced negative correlation in Figure 6 (right) conforms with this logic and is treated as desirable. Note that DRoP computes class densities to be exactly proportional to class errors as computed by the preliminary model, and the correlation is not identically -1 only because (1) DRoP does not execute a full training cycle of the preliminary model, producing noisy estimates of class errors (see Appendix E), and (2) some target class proportions computed by DRoP cannot be satisfied exactly because class density cannot exceed 1 (see lines 344-350 and note many classes with density capped at 1 in Figure 6).

We hope that we fully answered your questions and addressed all your concerns with our responses and changes to the manuscript. We thank you once again for your positive evaluation and hope that you will consider increasing your rating of our paper.

References
[1] Sagawa, S., et al. "Distributionally Robust Neural Networks". ICLR 2020.
[2] Aguilar-Ruiz, J. "Class-specific feature selection for classification explainability". 2024.
[3] Sorcher, B., et al. "Beyond Neural Scaling Laws: Beating Power Law Scaling via Data Pruning". NeurIPS 2022.
[4] Chaudhuri, K., et al. "Why does Throwing Away Data Improve Worst-Group Error?". ICML 2023.

We thank the reviewer for a thorough and encouranging assessment of our work. We address your comments below in two parts.

1. We would argue that the average and worst-class/group performance are in natural clash with each other, and it is accepted that improvements in the former almost inevitably lead to degradation of the latter (Chaudhuri et al., 2023). Prior art in DRO directly optimizes for worst-group accuracy alone, willing to accept lower average accuracy in return for improved robustness (Sagawa et al., 2020). Our work provides an intuitive explanation for this trade-off: the most difficult classes of the data distribution need more resources (in our case--larger presence in the dataset) to be well-learned, requiring us to shift our focus from and sacrifice some performance of the easier ones. While this reasoning might seem overly simplistic by portraying individual classes as antagonists playing a zero-sum game for resources, at the same time, it is realistic that different classes require different features to be learned by a fixed-capacity model and hence compete with one another (Aguilar-Ruiz, 2024). Our theoretical analysis provides a unique illustration of the trade-off between the average and worst-class performance, increasing the value of our contributions to the community. Further, our plots are designed to best visualize this trade-off across different methods by plotting results in the coordinates of both average and worst-class accuracy. We believe that they consistently show that DRoP traces a better trade-off than other methods, especially when used together with random pruning (Random+DRoP).

   Thus, average accuracy against datset density (leftmost plots in Figure 5) is not our key performance indicator, but we agree that it must be studied as well. Your observation that EL2N+DRoP mitigates some of the average accuracy degradation incurred by Random+DroP is related to the differences between score-based (e.g., EL2N) and random data pruning and depends on the compression rates. Sorcher et al. (2022) found that it is beneficial to retain more difficult examples picked by score-based methods only when pruning is not aggressive, whereas random pruning or inverse score-based pruning that retains easier samples is better at higher rates. Our results with and without DRoP confirm this phenomenon: pruning backed by score-based methods improves over random (Random, Random+DRoP, Random+StrategyQ) for high densities but quickly deteriorates for lower densities. Thus, your observation is valid in the high-density regime but not in low-density regime, which does indeed obscure the trends. In any case, we argue that this phenomenon is not related to DRoP but is idiosyncratic to existing data pruning methods; note that Random and Random+DRoP are almost indistinuishable on the leftmost plots in Figure 5, as well as EL2N and EL2N+DRoP.

We updated the manuscipt with additional evaluations on Wide-ResNet-101 (Figure 13 and the last paragraph of Appendix D). Since this model is generally intended for large-scale datasets like ImageNet, we had to modify the original architecture slightly and remove a few downsampling layers to account for the low resolution of CIFAR-100. These experiments confirm that DRoP can be successfully used with highly overparameterized large models that are known to be more robust, as was pointed out by Reviewer JvuS.