Boosting Model Resilience via Implicit Adversarial Data Augmentation

1 Introduction

Data augmentation techniques, designed to enrich the quantity and diversity of training samples, have demonstrated their effectiveness in improving the performance of deep neural networks (DNNs) [Maharana et al., 2022]. Existing methods can be divided into two categories. The first, explicit data augmentation [Cubuk et al., 2020; Xu and Zhao, 2023], applies geometric transformations to samples and directly integrates augmented instances into the training process, leading to reduced training efficiency. The second, a recent addition to this field, is the implicit data augmentation technique [Wang et al., 2019], which is inspired by the existence of numerous semantic vectors within the deep feature space of DNNs. This method emphasizes enhancing the deep features of samples and is achieved by optimizing robust losses instead of explicitly conducting the augmentation process, resulting in a more efficient and effective approach. Subsequent studies in imbalanced learning have extended this approach. For example, MetaSAug [Li et al., 2021] refines the accuracy of covariance matrices for minor classes by minimizing losses on a balanced validation set. RISDA [Chen et al., 2022] generates diverse instances for minor classes by extracting semantic vectors from the deep feature space of both the current class and analogous classes.

* Corresponding authors.

Despite these promising efforts, current augmentation strategies still exhibit notable limitations. Firstly, these approaches mainly enhance samples within the original training data space [Xu and Zhao, 2023; Wang et al., 2019], falling short in effectively mitigating the distributional discrepancies between training and test data, such as noise [Zheng et al., 2021] and subpopulation shifts [Yao et al., 2022]. Secondly, previous algorithms [Li et al., 2021; Chen et al., 2022] mostly operate at the category level, causing different samples within the same class to share identical augmentation distributions and strengths, which is potentially unreasonable and inaccurate. For instance, in noisy learning scenarios, it is advisable to treat noisy samples separately to mitigate their negative impact on model training [Zhou et al., 2023].

This study introduces a novel Implicit Adversarial Data Augmentation (IADA) approach, which conceptually embodies two main characteristics to address the two bottlenecks above. Firstly, as illustrated in Fig. 1(a), IADA enriches the deep features of samples by randomly sampling perturbation vectors from their adversarial and anti-adversarial perturbation distributions, surpassing the limitation of augmenting within the original training distribution. With this strategy, the classifier is anticipated to be dynamically adjusted by modifying the learning difficulty of samples. Secondly, the augmentation distribution for each sample is tailored based on its unique training characteristics, granting it the ability to address data biases beyond the category level. Specifically, these distributions are modeled as multivariate normal distributions, characterized by sample-wise perturbations and class-specific covariance matrices. Fig. 1(b) demonstrates the two features of our method using imbalanced learning as an example scenario, where the classifier typically favors major classes while underperforming on the minor ones, as well as favors easy samples (e.g., dogs on grass) but commonly mispredicting hard samples (e.g., dogs in the water) 1 . In this scenario, our method adopts anti-adversarial augmentation for major classes and adversarial augmentation (with higher strength) for minor ones. Meanwhile, adversarial augmentation is also applied to hard samples within major classes, ultimately facilitating better learning of class boundaries.

By exploring an infinite number of augmentations, we theoretically derive a surrogate loss for our augmentation strategy, thereby eliminating the need for explicit augmentation. Subsequently, to determine the perturbation strategies for samples in this loss, we construct a meta-learningbased framework, in which a perturbation network is tasked with computing perturbation strategies by leveraging diverse training characteristics extracted from the classifier as inputs. The training of all parameters in the perturbation network is guided by a small, unbiased meta dataset, enabling the generation of well-founded perturbation strategies for samples. Extensive experiments show that our method adeptly addresses various data biases, such as noise, imbalance, and subpopulation shifts, consistently achieving state-of-the-art (SOTA) performance among all compared methods.

In summary, our contributions in this paper are threefold.

• We propose a novel perspective on data augmentation, wherein samples undergo augmentation within their adversarial and anti-adversarial perturbation distributions, to facilitate model training across diversified learning scenarios, particularly those with data biases.
• In accordance with our augmentation perspective, we derive a new logit-adjusted loss and incorporate it into a well-designed meta-learning framework to optimize the classifier, unlocking the potential of data augmentation without an explicit augmentation procedure.
• We conduct extensive experiments across four typical biased learning scenarios, encompassing long-tail (LT) learning, generalized long-tail (GLT) learning, noisy label learning, and subpopulation shift learning. The results conclusively demonstrate the effectiveness and broad applicability of our approach.

2 RelatedWork

Data Augmentation methods have showcased their capacity to improve DNNs' performance by expanding and diversifying training data [Maharana et al., 2022]. Explicit augmentation directly incorporates augmented data into the training process, albeit at the expense of reduced training efficiency [Cubuk et al., 2020; Taylor and Nitschke, 2018; Xu and Zhao, 2023]. Recently, Wang et al. [2019] introduced an implicit semantic data augmentation approach, named ISDA, which transforms the deep features of samples within the semantic space of DNNs and boils down to the optimization of a robust loss. Subsequent studies [Li et al., 2021; Chen et al., 2022] in image classification tasks have extended this approach. However, these methods still struggle with effectively improving model performance when dealing with data biases that go beyond the category level.

1 This example stems from the observation that the majority of dogs in the training set are on grass and seldom in the water.

Adversarial and Anti-Adversarial Perturbations transform samples in directions that respectively move towards and away from the decision boundary, thereby modifying samples' learning difficulty [Lee et al., 2023; Zhou et al., 2023]. Consequently, models allocate varying levels of attention to samples subjected to their perturbations. Research has confirmed that incorporating adversarial and anti-adversarial samples during training assists models in achieving a better tradeoff between robustness and generalization [Zhou et al., 2023; Zhu et al., 2021]. However, existing adversarial training methods primarily focus on two specific types of perturbations that maximize and minimize losses [Xu et al., 2021; Zhou et al., 2023], posing limitations. Moreover, generating adversarial perturbations within the input space is timeconsuming [Madry et al., 2018]. Different from prior studies, our approach randomly selects perturbation vectors from both adversarial and anti-adversarial perturbation distributions, enabling the generation of multiple distinct adversarial and antiadversarial samples. Furthermore, the perturbations are generated within the deep feature space, enhancing efficiency and ensuring universality across various data types.

3 Implicit Adversarial Data Augmentation

We initially introduce a sample-wise adversarial data augmentation strategy to facilitate model training across various learning scenarios. By considering infinite augmentations, we then derive a surrogate loss for our augmentation strategy.

3.1 Adversarial Data Augmentation

Consider training a deep classifier F, with weights Φ on a training set, denoted as Dtr = {(xi, yi)}Ni=1 , where N refers to the number of training samples, and yi ∈ {1, · · · , C} represents the label of sample xi. The deep feature (before logit) learned by F for xi is represented as a H-dimensional vector hi = FΦ(xi) ∈ RH.

Our augmentation strategy enhances samples within the deep feature space of DNNs. The perturbation vectors for the deep feature of each sample are randomly extracted from either its adversarial or anti-adversarial perturbation distributions. These distributions are modeled as multivariate normal distributions, N(δi,Σyi ), where δi refers to the sample perturbation, andΣyi represents the class-specific covariance matrix estimated from the features of all training samples in class yi. As samples undergo augmentation within the deep feature space, perturbations should also be generated within this space, facilitating semantic alterations for training samples. Consequently, the perturbation vector δi for sample xi is calculated as ϵi·sign(∇hi ℓCE i ), where sign(∇hi ℓCE i ) signifies the gradient sign of the CE loss ℓCE i with respect to hi. The parameter ϵi plays a pivotal role in determining the perturbation strategy applied to xi, encompassing both the perturbation direction and bound. Its positive or negative sign signifies adversarial or anti-adversarial perturbations, respectively. Furthermore, the absolute value |ϵi| governs the perturbation bound. In practical applications, the value of ϵi is dynamically computed through a perturbation network based on the training characteristics of xi, which will be elaborated in Section 4. Additionally, the class-specific covariance matrix Σyi within this distribution aids in preserving the covariance structure of each class. Its value is estimated in real-time by aggregating statistics from all mini-batches, as detailed in Section I of the Appendix. Regarding the augmentation strength quantified by the number of augmented instances Mi for xi, we define Mi as M/πyi , where M is a constant and πyi represents the proportion of class yi in the training data. Accordingly, a smaller proportion results in a larger number of augmented instances, ensuring class balance.

To compute the augmented features ˜hi from hi, we transform hi along random directions sampled from N(δi,Σyi ). This transformation yields ˜hi ∼ N(hi + δi, αΣyi ), where the parameter α controls the extent of dispersion for augmented samples. In summary, our adversarial data augmentation strategy offers the following advantages:

• Instead of augmenting samples within the original data space, our approach enhances them within their adversarial and anti-adversarial perturbation distributions. This method effectively adjusts the learning difficulty distribution of training samples, fostering improved generalization and robustness in DNNs.
• Our sample-wise augmentation distribution customizes the mean vector based on the unique training characteristics of each sample. This personalized strategy significantly enhances models' ability to address data biases, encompassing those beyond the category level.

3.2 IADA Loss

With our augmentation strategy, a straightforward way to train a classifier involves augmenting each hi for Mi times. This procedure generates an augmented feature set for each sample, {˜h1i , · · · , ˜hMi i }. Subsequently, the CE loss for all augmented samples is as follows:

where ˆM= ∑Ni=1 Mi. Additionally, W =[w1,· · ·,wC]T ∈ RC×H and b = [b1, · · · , bC]T ∈ RC , in which wj and bj refer to the weight vector and bias corresponding to the last fully connected layer for class j. Considering augmenting more data while enhancing training efficiency, we explore augmenting an infinite number of times for the deep feature of each training sample. As M in Mi approaches infinity, the expected CE loss is expressed as:

However, accurately calculating Eq. (2) poses a challenge. Hence, we proceed to derive a computationally efficient surrogate loss for it. Given the concavity of the logarithmic function log (·), using Jensen's inequality, E[logX] ≤ logE[X], we derive an upper bound of Eq. (2) as follows:

where ∆wj,yi =wTj -wTyi and ∆bj,yi = bj - byi . As ˜hi is a Gaussian random variable adhering to N(hi + δi, αΣyi ), we know that ∆wj,yi ˜hi + ∆bj,yi ∼N (∆wj,yi (hi + δi) + ∆bj,yi , α∆wj,yi Σyi ∆wTj,yi ). Subsequently, utilizing the moment-generating function,

the upper bound of Eq. (3) can be represented as

where Z j i = wj(hi + δi) + bj + αρji and ρji = 12 ∆wj,yi Σyi ∆wTj,yi .

Drawing inspiration from the Logit Adjustment (LA) approach [Menon et al., 2021], we introduce its logit adjustment term in place of the class-wise weight 1/πyi , providing a more effective solution for imbalanced class distributions. Consequently, the final IADA loss is formulated as follows:

where ˜ Z j i = wj(hi + δi) + bj +αρji + β logπj. The symbols α and β serve as two hyperparameters in the IADA loss, frequently set to 0.5 and 1, respectively, in practical applications. The IADA loss, essentially a logit-adjusted variant of the CE loss, operates as a surrogacy for our proposed adversarial data augmentation strategy. Therefore, instead of explicitly executing the augmentation process, we can directly optimize this loss, thereby improving efficiency.

We further explain the IADA loss, defined in Eq. (6), from a regularization perspective using the Taylor expansion. This process reveals three regularization terms stemming from our adversarial data augmentation strategy, as outlined in Table 1. A detailed analysis of these terms is presented in Section III of the Appendix. Through our analysis, the first term G diminishes the mapped variances of deep features within each class, thereby enhancing intra-class compactness and improving the generalization ability of models. The second term R reinforces model robustness by increasing the cosine similarity between the classification boundary and the gradient vectors of adversarial samples. Furthermore, the third term F promotes fairness among classes by favoring less-represented categories. Collectively, the regularization terms incorporated in the IADA loss significantly contribute to strengthening the generalization, robustness, and inter-class fairness of DNNs, as depicted in Fig. 2 (Box 2).

4 Optimization Using IADA Loss

Due to the necessity of pre-determining the value of ϵi in δi, which governs the perturbation strategies, when utilizing the IADA loss, we construct a meta-learning-based framework named Meta-IADA. This framework is designed to optimize classifiers using the IADA loss. As illustrated in Fig. 2

Algorithm 1: Algorithm of Meta-IADA

Input: Training data Dtr , metadata Dmeta , batch sizes n and m, ending iterations T1 and T2.

Output: Learned classifier parameter Φ.

• 1 Initialize classifier parameter Φ1 and perturbation network parameter Ω1 ;
• 2 for t ≤ T1 do
• 3 Sample {(xi, yi)}ni=1 fromDtr ;

4 Update Φt+1 ←Φt - η1 1n

∑ni=1 ∇ΦℓCE

5 end

• 7 Sample {(xi, yi)}ni=1 fromDtr ;
• 8 Sample {(xmeta i , ymeta i )}mi=1 formDmeta ;
• 9 Obtain current covariance matrices Σ;

10 Formulate Φt+1 by Eq. (7);

11 Update Ωt+1 by Eq. (8);

12 Update Σt+1 by Eq. (9);

13 Update Φt+1 by Eq. (10);

14 end

(Box 3), Meta-IADA comprises four main components: the classifier, the characteristics extraction module, the perturbation network, and the meta-learning-based learning strategy.

Considering that determining perturbation strategies for samples involves factors including their learning difficulty, class distribution, and noise levels [Zhou et al., 2023; Xu et al., 2021], we extract fifteen training characteristics (e.g., sample loss and margin) from the classifier to encompass these aspects. All characteristics are comprehensively introduced in Section IV of the Appendix. These extracted characteristics then serve as inputs to the perturbation network, assisting in computing the values of ϵi. Within our framework, the perturbation network employs a two-layer MLP 2 , known theoretically as a universal approximator for nearly any continuous function. Its output passes through a Tanh function to constrain the range of ϵi within (-1, 1).

Meta-IADA employs a meta-learning-based strategy to iteratively update the classifier and the perturbation network. This involves leveraging a high-quality (clean and balanced) yet small meta dataset, Dmeta = {(xmeta i , ymeta i )}Mi=1 . Additionally, to mitigate the accuracy compromise within Σyi for minor classes due to the constraints of limited training data, their values are further updated on the metadata. Let Ω represent the parameters of the perturbation network. The optimization process within Meta-IADA is detailed as follows:

Initially, the parameters of the classifier, Φ, are updated using stochastic gradient descent (SGD) on a mini-batch of training samples {(xi, yi)}ni=1 with the following objective:

where η1 is the step size. Additionally, f ti denotes the concatenated vector containing the extracted training character-

2 A comparative analysis of alternative architectures for the perturbation network is detailed in Section V of the Appendix.

i ;

istics for xi at the tth iteration. Subsequently, leveraging the optimized Φt+1 , the parameter update in the perturbation network, Ω, entails utilizing a mini-batch of metadata {(xmeta i , ymeta i )}mi=1 :

where η2 denotes the step size. Simultaneously, the optimization of covariance matrices is conducted using the metadata, outlined as follows:

Finally, leveraging the computed perturbations and updated covariance matrices, we proceed to update the parameters Φ of the classifier in the following manner:

Similar to MetaAug [Li et al., 2021], to acquire bettergeneralized representations, the classifier is initially trained using vanilla CE loss, followed by trained with Meta-IADA. The algorithm for Meta-IADA is delineated in Algorithm 1.

5 Experiments

We experiment across four typical biased learning scenarios, including LT learning, GLT learning, noisy label learning, and subpopulation shift learning, involving image and text datasets. The excluded settings and results (including those on standard datasets) are detailed in the Appendix. The code for Meta-IADA is available in the supplementary materials.

5.1 Long-Tail Learning

Four LT image classification benchmarks, CIFAR-LT [Cui et al., 2019], ImageNet-LT [Liu et al., 2019], Places-LT [Liu et al., 2019], and iNaturalist (iNat) 2018 [Jamal et al., 2020], are evaluated. Additionally, two imbalanced text classification datasets are included. Due to space limitations, we only present experiments for CIFAR-LT and iNat in the main text.

Experiments on CIFAR-LT Datasets. We employ the ResNet-32 model [He et al., 2016] with an initial learning rate of 0.1. The training employs the SGD optimizer with a momentum of 0.9 and a weight decay of 5×10-4 on a single GPU, spanning 200 epochs. The learning rate is decayed by 0.01 at the 160th and 180th epochs. Additionally, the perturbation network is optimized using Adam, with an initial learning rate of 1×10-3 . To construct metadata, we randomly select ten images per class from the validation data. For the hyperparameters in the IADA loss, α is selected from {0.1, 0.25, 0.5, 0.75, 1}, while keeping β fixed at 1.

From the results reported in Table 2, Meta-IADA displays remarkable superiority over other LT baselines, underscoring its effectiveness in managing imbalanced class distributions. Additionally, it outperforms previous implicit augmentation methods, providing evidence for the efficacy of augmenting samples within their adversarial and anti-adversarial perturbation distributions. Furthermore, as depicted in Fig. 3, MetaIADA induces a lower proportion of adversarial samples in major classes ("C1" to "C5"), whereas minor classes ("C6" to "C10") exhibit a higher proportion. This manifests the model's increased attention on samples in tail classes. Comparative analyses of confusion matrices involving CE loss, MetaSAug, and Meta-IADA are presented in Section V of the Appendix. The results unveil that Meta-IADA remarkably increases the accuracy of both major and minor classes. Conversely, while MetaSAug improves the performance of minor categories, it compromises the accuracy of major classes.

Experiments on iNat 2018Dataset. The ResNet-50model serves as the backbone classifier, pre-trained on ImageNet [Russakovsky et al., 2015] and iNat 2017 [Horn et al., 2018] datasets. The perturbation network is optimized using Adam, with an initial learning rate of 1×10-4 . Other settings follow those outlined in the MetaSAug [Li et al., 2021] paper. As reported in Table 3, Meta-IADA outperforms other comparative approaches tailored for LT learning. This suggests that, even in situations with imbalanced class distributions, employing a sample-level strategy proves more effective, as finer-grained imbalances within each class may also exist.

5.2 Generalized Long-Tail Learning

GLT learning considers both long-tailed class and attribute distributions in the training data. We employ two GLT benchmarks, ImageNet-GLT, and MSCOCO-GLT [Tang et al., 2022]. Each benchmark comprises three protocols, CLT, ALT, and GLT, showcasing variations in class distribution, attribute distribution, and combinations of both between training and testing datasets. The ResNeXt-50 [Xie et al., 2017] model is utilized as the backbone network. We train models with a batch size of 256 and an initial learning rate of 0.1, using SGD with a weight decay of 5×10-4 and a momentum of 0.9. The perturbation network is optimized using the Adam optimizer, initialized with a learning rate of 1×10-3 . The metadata utilized in this experiment is balanced in both classes and attributes. We adopt the construction method of Tang et al. [2022], which involves clustering images in each class into six groups using KMeans with a pre-trained ResNet-50 model. Two images are then randomly selected from each group and class within the validation data.

The comparative results for ImageNet-GLT are outlined in Table 4, while those for MSCOCO-GLT are presented in the Appendix. Meta-IADA demonstrates substantial enhancements in accuracy and precision across all three protocols, emphasizing its ability to address distributional skewness in three scenarios, including attribute imbalance, class imbalance, and their combination. The efficacy of Meta-IADA stems from its ability to apply adversarial augmentation to samples from tail classes and those with rare attributes. This significantly magnifies the impact of these samples on model training, resulting in improved prediction accuracy. However, methods specifically designed for LT learning demonstrate subpar performance on the ALT protocol, primarily due to their class-level characteristics.

5.3 Noisy Label Learning

We examine two types of label corruptions: uniform and pairflip noise [Shu et al., 2019], using CIFAR [Krizhevsky and Hinton, 2009] datasets. The Wide ResNet-28-10 (WRN-2810) [Zagoruyko and Komodakis, 2016] and ResNet-32 models are utilized for uniform and flip noises, respectively. 1,000 images with clean labels are selected from the validation set to compile the metadata. The ResNet settings match those used for CIFAR-LT. WRN-28-10 is trained using SGD with an initial learning rate of 0.1, a momentum of 0.9, and a weight decay of 5×10-4 ; the learning rate is decayed by 0.1 at the 50th and 55th epochs during the total 60 epochs. The Adam optimizer, initialized with a learning rate of 1×10-3 , is utilized for optimizing the perturbation network.

Table 5 presents the comparison results for flip noise, while those for uniform noise are detailed in the Appendix. MetaIADA consistently achieves SOTA performance when compared to all other methods, surpassing the highest accuracy among comparative methods by an average of 2%. These outcomes underscore its capacity to bolster DNNs' robustness against noise. An analysis of Fig. 4 indicates that nearly all noisy samples undergo anti-adversarial augmentations in Meta-IADA, effectively mitigating the negative impact of noisy samples on the overall performance of DNNs.

5.4 Subpopulation Shift Learning

We conduct evaluations on four binary classification datasets characterized by subpopulation shifts: Colored MNIST (CMNIST) [Yao et al., 2022], Waterbirds [Sagawa et al., 2020], CelebA [Liu et al., 2016], and CivilComments [Borkan et al., 2019]. For three image datasets (i.e., CMNIST, Waterbirds, and CelebA), we utilize ResNet-50 [He et al., 2016] as the backbone network, while for the text dataset, CivilComments, we employ DistilBert [Sanh et al., 2019]. To provide a comprehensive assessment, we report both average and worstgroup accuracy. Detailed experimental settings and dataset introductions are available in Section V of the Appendix.

Based on the results in Table 6, Meta-IADA achieves the highest worst-group accuracy across the four datasets. This emphasizes its effectiveness in enhancing performance for underrepresented groups, such as samples in the landbird class with a water background. Typically, these samples benefit from adversarial augmentation, enhancing their influence on model training. Furthermore, except for the Waterbirds dataset, Meta-IADA surpasses other methods in terms of average accuracy. These findings illustrate Meta-IADA's capability to bolster model resilience against subpopulation shifts.

5.5 Visualization Results

We utilize the visualization method introduced in ISDA [Wang et al., 2019], projecting the features augmented by Meta-IADA back into the pixel space. The results, depicted in Fig. 5, highlight the diversity encapsulated within the generated adversarial and anti-adversarial samples. Additionally, samples created through adversarial and anti-adversarial augmentation commonly showcase varying levels of difficulty compared to the original samples. These modifications are attributed to transformations within the deep feature space, influenced by semantic vectors associated with attributes such as angles, colors, and backgrounds.

5.6 Ablation and Sensitivity Studies

Ablation studies are conducted to analyze the impact of the three regularization terms within the IADA loss. The results reported in Table 7, emphasize the crucial roles played by both the generalization term G and the robustness term R. Additionally, in the context of an imbalanced scenario, the fairness term F also demonstrates its significance. Furthermore, sensitivity tests are performed on the hyperparameters α and β, which respectively control the effects of G and F. As shown in Fig. 6, Meta-IADA achieves optimal performance when α is around 0.5 and β approaches 1. Besides, the stable ranges for α and β lie within [0.25, 0.75] and [0.75, 1.25], respectively. Based on these findings, we recommend setting α=0.5 and β=1 for practical applications.

6 Conclusion

This paper presents a novel adversarial data augmentation strategy to facilitate model training across diverse learning scenarios, particularly those with data biases. This strategy enriches the deep features of samples by incorporating their adversarial and anti-adversarial perturbation distributions, dynamically adjusting the learning difficulty of training samples. Subsequently, we formulate a surrogate loss for our augmentation strategy and establish a meta-learning framework to optimize classifiers using this loss. Extensive experiments are conducted across various biased learning scenarios involving different networks and datasets, showcasing the effectiveness and broad applicability of our approach.