Natural Corruption Robustness
Rain, blur, noise, and compression cut accuracy with no attacker involved. Coverage across corruptions, not locks against attackers, is the fix.
Why Does This Exist?
Deployed cameras meet motion blur, frost, pixelation, and JPEG artifacts that no attacker crafts and every user photographs. A clean 0.89 falls to 0.58 under the worst corruption here, with fog and blur leading. This is accident, not malice: no threat model, no budget, just coverage. The sibling for malice is adversarial defenses under robustness and security.
Think of It Like This
Road-testing cars in all weather
Carmakers test brakes on dry asphalt, rain, ice, and gravel because drivers meet all four without planning to. Corruption suites are weather tracks for models: fifteen surfaces at five intensities each. The analogy stops at transfer: all-weather tires help on every surface somewhat, while augmentation on blur need not help on frost at all.
How It Actually Works
Evaluate on a fixed corruption suite: fifteen corruption types times five severity levels, reporting mean accuracy and worst case rather than clean accuracy alone. Train with the same corruptions as augmentation, mixed into clean batches at moderate probability. Keep severity distributions realistic: training only at maximum severity teaches artifacts of the simulator instead of weather.
Worked example with recomputed numbers
Clean accuracy 0.89. Worst corruption at severity five, glass blur, drops a plain model to 0.58, a 0.31 gap, while mean across all 75 conditions reads 0.74. Train with corruption augmentation at 30 percent mix: worst case climbs to 0.76, a gain of 0.18, mean rises to 0.82, and clean accuracy eases to 0.87. Remove frost from training and frost scores revert to 0.61 while other corruptions hold, proving coverage is per-corruption rather than general hardening.
What to report
Report clean, mean-corrupted, and worst-corruption numbers as a triple at every checkpoint. A model that trades 0.02 clean for 0.18 worst-case is better for every outdoor deployment and worse for none, but only the triple makes that visible.
Watch Out For
Training on the test corruptions exactly
Augmenting with the identical simulator code and seeds as the benchmark teaches simulator fingerprints, and scores inflate while real rain still fails. The symptom is benchmark gains with no field improvement. Hold out whole corruption families and validate on real captured weather, not just simulated severities.
The Quick Version
- No adversary assumed: weather, blur, noise, and compression are the test.
- Demo triple: clean 0.89, mean 0.74, worst 0.58 on glass blur.
- Corruption augmentation at 30 percent mix moves the triple to 0.87, 0.82, 0.76.
- Coverage is per corruption: missing frost leaves frost at 0.61.
- Report the triple always, and hold out families plus real weather.