mlsanityData to 7 Oct 2026

AugMax: Adversarial Composition of Random Augmentations for Robust Training

arXiv 2110.13771 ↗First posted 26 Oct 2021cs.CV cs.LGcited by 89

Not on the map. Why?

Abstract (arXiv)

Data augmentation is a simple yet effective way to improve the robustness of deep neural networks (DNNs). Diversity and hardness are two complementary dimensions of data augmentation to achieve robustness. For example, AugMix explores random compositions of a diverse set of augmentations to enhance broader coverage, while adversarial training generates adversarially hard samples to spot the weakness. Motivated by this, we propose a data augmentation framework, termed AugMax, to unify the two aspects of diversity and hardness. AugMax first randomly samples multiple augmentation operators and then learns an adversarial mixture of the selected operators. Being a stronger form of data augmentation, AugMax leads to a significantly augmented input distribution which makes model training more challenging. To solve this problem, we further design a disentangled normalization module, termed DuBIN (Dual-Batch-and-Instance Normalization), that disentangles the instance-wise feature heterogeneity arising from AugMax. Experiments show that AugMax-DuBIN leads to significantly improved out-of-distribution robustness, outperforming prior arts by 3.03%, 3.49%, 1.82% and 0.71% on CIFAR10-C, CIFAR100-C, Tiny ImageNet-C and ImageNet-C. Codes and pretrained models are available: https://github.com/VITA-Group/AugMax.

Key facts. Cited by 89 papers in the map (data through 7 Oct 2026). Builds on 60 of its 72 references that are in the map. First posted on arXiv 26 Oct 2021.

Builds on

60 of 72 references.

References · 60

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2016Layer Normalizationcited by 5,579
  5. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  6. 2016Wide Residual Networkscited by 3,057
  7. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  8. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  9. 2016Aggregated Residual Transformations for Deep Neural Networkscited by 2,540
  10. 2020The Many Faces of Robustness: A Critical Analysis of Out-of-Distribution Generalizationcited by 1,842
  11. 2018Group Normalizationcited by 1,514
  12. 2019Do ImageNet Classifiers Generalize to ImageNet?cited by 1,507
38 more
  1. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  2. 2019Natural Adversarial Examplescited by 1,401
  3. 2017Random Erasing Data Augmentationcited by 1,235
  4. 2016Instance Normalization: The Missing Ingredient for Fast Stylizationcited by 1,187
  5. 2019Learning Robust Global Representations by Penalizing Local Predictive Powercited by 1,010
  6. 2019When Does Label Smoothing Help?cited by 985
  7. 2019AugMix: A Simple Data Processing Method to Improve Robustness and Uncertaintycited by 897
  8. 2018Robustness May Be at Odds with Accuracycited by 873
  9. 2018AutoAugment: Learning Augmentation Policies from Datacited by 728
  10. 2020Measuring Robustness to Natural Distribution Shifts in Image Classificationcited by 452
  11. 2018Generalizing to Unseen Domains via Adversarial Data Augmentationcited by 451
  12. 2019Making Convolutional Networks Shift-Invariant Againcited by 390
  13. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
  14. 2018Two at Once: Enhancing Learning and Generalization Capacities via IBN-Netcited by 361
  15. 2019Adversarial Examples Improve Image Recognitioncited by 283
  16. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
  17. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  18. 2018Why do deep convolutional networks generalize so poorly to small image transformations?cited by 198
  19. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  20. 2018Do CIFAR-10 Classifiers Generalize to CIFAR-10?cited by 197
  21. 2018Spatially Transformed Adversarial Examplescited by 195
  22. 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 182
  23. 2018Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approachcited by 181
  24. 2019You Only Propagate Once: Accelerating Adversarial Training via Maximal Principlecited by 181
  25. 2016Improving the Robustness of Deep Neural Networks via Stability Trainingcited by 156
  26. 2020Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuningcited by 152
  27. 2020Robust Pre-Training by Adversarial Contrastive Learningcited by 144
  28. 2020Maximum-Entropy Adversarial Data Augmentation for Improved Generalization and Robustnesscited by 121
  29. 2019Adversarial Examples Are a Natural Consequence of Test Error in Noisecited by 114
  30. 2021Model-Based Domain Generalizationcited by 103
  31. 2018Batch-Instance Normalization for Adaptively Style-Invariant Neural Networkscited by 77
  32. 2020Shape-Texture Debiased Neural Network Trainingcited by 76
  33. 2019Model Compression with Adversarial Robustness: A Unified Optimization Frameworkcited by 71
  34. 2019Do Image Classifiers Generalize Across Time?cited by 59
  35. 2020Once-for-All Adversarial Training: In-Situ Tradeoff between Robustness and Accuracy for Freecited by 48
  36. 2020Triple Wins: Boosting Accuracy, Robustness and Efficiency Together by Enabling Input-Adaptive Inferencecited by 45
  37. 2020Maximum Mean Discrepancy Test is Aware of Adversarial Attackscited by 44
  38. 2021When Human Pose Estimation Meets Robustness: Adversarial Algorithms and Benchmarkscited by 41

50 most cited of 60 All 60 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 3; 2022: 24; 2023: 29; 2024: 16; 2025: 7; 2026: 10.

89 papers.

Sort:

By area:

  1. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  2. 2022Style-Hallucinated Dual Consistency Learning for Domain Generalized Semantic Segmentationcited by 88
  3. 2022A Survey on Long-Tailed Visual Recognitioncited by 75
  4. 2023Graph Mixture of Experts: Learning on Large-Scale Graphs with Explicit Diversity Modelingcited by 63
  5. 2022A Close Look into the Calibration of Pre-trained Language Modelscited by 57
  6. 2021OOD-CV: A Benchmark for Robustness to Out-of-Distribution Shifts of Individual Nuisances in Natural Imagescited by 46
  7. 2022Aug-NeRF: Training Stronger Neural Radiance Fields with Triple-Level Physically-Grounded Augmentationscited by 46
  8. 2022Efficient and Effective Augmentation Strategy for Adversarial Trainingcited by 43
  9. 2023Data Augmentation Alone Can Improve Adversarial Trainingcited by 43
  10. 2021PRIME: A few primitives can boost robustness to common corruptionscited by 40
  11. 2021Pyramid Adversarial Training Improves ViT Performancecited by 39
  12. 2022Efficient Split-Mix Federated Learning for On-Demand and In-Situ Customizationcited by 34
38 more
  1. 2022Towards Improving Calibration in Object Detection Under Domain Shiftcited by 26
  2. 2022Removing Batch Normalization Boosts Adversarial Trainingcited by 24
  3. 2023Random Boxes Are Open-world Object Detectorscited by 24
  4. 2022ALLSH: Active Learning Guided by Local Sensitivity and Hardnesscited by 23
  5. 2022Enhance the Visual Representation via Discrete Adversarial Trainingcited by 23
  6. 2024Text-Guided Attention is All You Need for Zero-Shot Robustness in Vision-Language Modelscited by 23
  7. 2022Style-Hallucinated Dual Consistency Learning: A Unified Framework for Visual Domain Generalizationcited by 22
  8. 2023Adversarial Bayesian Augmentation for Single-Source Domain Generalizationcited by 21
  9. 2023A Survey on the Robustness of Computer Vision Models against Common Corruptionscited by 20
  10. 2024Fourier-basis Functions to Bridge Augmentation Gap: Rethinking Frequency Augmentation in Image Classificationcited by 18
  11. 2022NoisyMix: Boosting Model Robustness to Common Corruptionscited by 17
  12. 2023New Insights for the Stability-Plasticity Dilemma in Online Continual Learningcited by 16
  13. 2023Temporal Coherent Test-Time Optimization for Robust Video Classificationcited by 15
  14. 2023Average of Pruning: Improving Performance and Stability of Out-of-Distribution Detectioncited by 14
  15. 2023IPMix: Label-Preserving Data Augmentation Method for Training Robust Classifierscited by 14
  16. 2023Robust Weight Signatures: Gaining Robustness as Easy as Patching Weights?cited by 13
  17. 2023OOD-CV-v2: An extended Benchmark for Robustness to Out-of-Distribution Shifts of Individual Nuisances in Natural Imagescited by 12
  18. 2023HybridAugment++: Unified Frequency Spectra Perturbations for Model Robustnesscited by 12
  19. 2024Dynamic Sparse Training versus Dense Training: The Unexpected Winner in Image Corruption Robustnesscited by 11
  20. 2022Invariant Learning via Diffusion Dreamed Distribution Shiftscited by 10
  21. 2022When Neural Networks Fail to Generalize? A Model Sensitivity Perspectivecited by 10
  22. 2023Learning Better with Less: Effective Augmentation for Sample-Efficient Visual Reinforcement Learningcited by 8
  23. 2023Spectral Adversarial MixUp for Few-Shot Unsupervised Domain Adaptationcited by 8
  24. 2022Better May Not Be Fairer: A Study on Subgroup Discrepancy in Image Classificationcited by 7
  25. 2023Bag of Tricks for In-Distribution Calibration of Pretrained Transformerscited by 7
  26. 2023AROID: Improving Adversarial Robustness Through Online Instance-Wise Data Augmentationcited by 6
  27. 2022Deeper Insights into the Robustness of ViTs towards Common Corruptionscited by 5
  28. 2022Augmentation Backdoorscited by 5
  29. 2023Anchor Data Augmentationcited by 5
  30. 2024Domain-Guided Weight Modulation for Semi-Supervised Domain Generalizationcited by 5
  31. 2025Robust Asymmetric Heterogeneous Federated Learning with Corrupted Clientscited by 5
  32. 2022On Certifying and Improving Generalization to Unseen Domainscited by 4
  33. 2022Dynamic Test-Time Augmentation via Differentiable Functionscited by 4
  34. 2023adSformers: Personalization from Short-Term Sequences and Diversity of Representations in Etsy Adscited by 4
  35. 2023DFM-X: Augmentation by Leveraging Prior Knowledge of Shortcut Learningcited by 4
  36. 2024Crafting Distribution Shifts for Validation and Training in Single Source Domain Generalizationcited by 4
  37. 2025Differentiable Entropy Regularization: A Complexity-Aware Approach for Neural Optimizationcited by 4
  38. 2026StableVLA: Towards Robust Vision-Language-Action Models without Extra Datacited by 4

50 most cited of 89 All 89 (JSON)