Modern neural networks excel at image classification, yet they remain vulnerable to common image corruptions such as blur, speckle noise or fog. Recent methods that focus on this problem, such as AugMix and DeepAugment, introduce defenses that operate in expectation over a distribution of image corruptions. In contrast, the literature on $\ell_p$-norm bounded perturbations focuses on defenses against worst-case corruptions. In this work, we reconcile both approaches by proposing AdversarialAugment, a technique which optimizes the parameters of image-to-image models to generate adversarially corrupted augmented images. We theoretically motivate our method and give sufficient conditions for the consistency of its idealized version as well as that of DeepAugment. Our classifiers improve upon the state-of-the-art on common image corruption benchmarks conducted in expectation on CIFAR-10-C and improve worst-case performance against $\ell_p$-norm bounded perturbations on both CIFAR-10 and ImageNet.

翻译：现代神经网络在图像分类方面非常出色,但是它们仍然容易受到模糊、闪烁噪音或雾等普通图像腐败的影响。最近一些侧重于这一问题的方法,如AugMix和DeepAugment等,引入了对图像腐败分布的预期性防守。相反,关于$_p$-norm 受约束的扰动的文献侧重于防范最坏的腐败。在这项工作中,我们通过提议反向放大技术来调和这两种方法。这种技术优化了图像到图像模型的参数,以生成对抗性腐蚀的扩大图像。我们理论上激励了我们的方法,并为其理想化版本和深层Augment的一致性提供了充分的条件。我们的分类者们改进了期待CIFAR-10-C在通用图像腐败基准方面的艺术状态,并改进了CIFAR-10和图像网络上对美元/el_p$norm受约束的干扰。