Boosting Model Resilience via Implicit Adversarial Data Augmentation
Xiaoling Zhou Wei Ye Zhemg Lee Rui Xie Shikun Zhang


[
    Jacob B. Fiedler
    April 29, 2024
====================


[1]Corresponding authors.






Data augmentation plays a pivotal role in enhancing and diversifying training data. Nonetheless, consistently improving model performance in varied learning scenarios, especially those with inherent data biases, remains challenging. To address this, we propose to augment the deep features of samples by incorporating their adversarial and anti-adversarial perturbation distributions, enabling adaptive adjustment in the learning difficulty tailored to each sample’s specific characteristics. We then theoretically reveal that our augmentation process approximates the optimization of a surrogate loss function as the number of augmented copies increases indefinitely. This insight leads us to develop a meta-learning-based framework for optimizing classifiers with this novel loss, introducing the effects of augmentation while bypassing the explicit augmentation process. We conduct extensive experiments across four common biased learning scenarios: long-tail learning, generalized long-tail learning, noisy label learning, and subpopulation shift learning. The empirical results demonstrate that our method consistently achieves state-of-the-art performance, highlighting its broad adaptability.







§ INTRODUCTION

Data augmentation techniques, designed to enrich the quantity and diversity of training samples, have demonstrated their effectiveness in improving the performance of deep neural networks (DNNs) <cit.>. Existing methods can be divided into two categories. The first, explicit data augmentation <cit.>, applies geometric transformations to samples and directly integrates augmented instances into the training process, leading to reduced training efficiency. The second, a recent addition to this field, is the implicit data augmentation technique <cit.>, which is inspired by the existence of numerous semantic vectors within the deep feature space of DNNs. This method emphasizes enhancing the deep features of samples and is achieved by optimizing robust losses instead of explicitly conducting the augmentation process, resulting in a more efficient and effective approach. Subsequent studies in imbalanced learning have extended this approach.  
For example, 
MetaSAug <cit.> refines the accuracy of covariance matrices for minor classes by minimizing losses on a balanced validation set. RISDA <cit.> generates diverse instances for minor classes by extracting semantic vectors from the deep feature space of both the current class and analogous classes.











Despite these promising efforts, current augmentation strategies still exhibit notable limitations. Firstly, these approaches mainly enhance samples within the original training data space <cit.>, falling short in effectively mitigating the distributional discrepancies between training and test data, such as noise <cit.> and subpopulation shifts <cit.>.
Secondly, previous algorithms <cit.> mostly operate at the category level, causing different samples within the same class to share identical augmentation distributions and strengths, which is potentially unreasonable and inaccurate. 
For instance, in noisy learning scenarios, it is advisable to treat noisy samples separately to mitigate their negative impact on model training <cit.>.



















This study introduces a novel Implicit Adversarial Data Augmentation (IADA) approach, which conceptually embodies two main characteristics to address the two bottlenecks above. Firstly, as illustrated in Fig. <ref>(a), IADA enriches the deep features of samples by randomly sampling perturbation vectors from their adversarial and anti-adversarial perturbation distributions, surpassing the limitation of augmenting within the original training distribution. With this strategy, the classifier is anticipated to be dynamically adjusted by modifying the learning difficulty of samples. 
Secondly, the augmentation distribution for each sample is tailored based on its unique training characteristics, granting it the ability to address data biases beyond the category level. Specifically, these distributions are modeled as multivariate normal distributions, characterized by sample-wise perturbations and class-specific covariance matrices. 
Fig. <ref>(b) demonstrates the two features of our method using imbalanced learning as an example scenario, where the classifier typically favors major classes while underperforming on the minor ones, as well as favors easy samples (e.g.,  dogs on grass) but commonly mispredicting hard samples (e.g., dogs in the water)[This example stems from the observation that the majority of dogs in the training set are on grass and seldom in the water.]. In this scenario, our method adopts anti-adversarial augmentation for major classes and adversarial augmentation (with higher strength) for minor ones. Meanwhile, adversarial augmentation is also applied to hard samples within major classes, ultimately facilitating better learning of class boundaries. 


By exploring an infinite number of augmentations, we theoretically derive a surrogate loss for our augmentation strategy, thereby eliminating the need for explicit augmentation. Subsequently, to determine the perturbation strategies for samples in this loss, we construct a meta-learning-based framework, in which a perturbation network is tasked with computing perturbation strategies by leveraging diverse training characteristics extracted from the classifier as inputs. The training of all parameters in the perturbation network is guided by a small, unbiased meta dataset, enabling the generation of well-founded perturbation strategies for samples. 
Extensive experiments show that our method adeptly addresses various data biases, such as noise, imbalance, and subpopulation shifts, consistently achieving state-of-the-art (SOTA) performance among all compared methods.

















































































In summary, our contributions in this paper are threefold.

    
  * We propose a novel perspective on data augmentation, wherein samples undergo augmentation within their adversarial and anti-adversarial perturbation distributions, to facilitate model training across diversified learning scenarios, particularly those with data biases. 
    
    
  * In accordance with our augmentation perspective, we derive a new logit-adjusted loss and incorporate it into a well-designed meta-learning framework to optimize the classifier, unlocking the potential of data augmentation without an explicit augmentation procedure. 

    
  * We conduct extensive experiments across four typical biased learning scenarios, encompassing long-tail (LT) learning, generalized long-tail (GLT) learning, noisy label learning, and subpopulation shift learning. The results conclusively demonstrate the effectiveness and broad applicability of our approach.







§ RELATED WORK































  
Data Augmentation methods have showcased their capacity to improve DNNs' performance by expanding and diversifying training data <cit.>. Explicit augmentation directly incorporates augmented data into the training process, albeit at the expense of reduced training efficiency <cit.>. Recently, Wang et al. r8 introduced an implicit semantic data augmentation approach, named ISDA, which transforms the deep features of samples within the semantic space of DNNs and boils down to the optimization of a robust loss. Subsequent studies <cit.> in image classification tasks have extended this approach. However, these methods still struggle with effectively improving model performance when dealing with data biases that go beyond the category level.
































  
Adversarial and Anti-Adversarial Perturbations transform samples in directions that respectively move towards and away from the decision boundary, thereby modifying samples' learning difficulty <cit.>. Consequently, models allocate varying levels of attention to samples subjected to their perturbations. Research has confirmed that incorporating adversarial and anti-adversarial samples during training assists models in achieving a better tradeoff between robustness and generalization <cit.>. However, existing adversarial training methods primarily focus on two specific types of perturbations that maximize and minimize losses <cit.>, posing limitations. Moreover, generating adversarial perturbations within the input space is time-consuming <cit.>. Different from prior studies, our approach randomly selects perturbation vectors from both adversarial and anti-adversarial perturbation distributions, enabling the generation of multiple distinct adversarial and anti-adversarial samples. Furthermore, the perturbations are generated within the deep feature space, enhancing efficiency and ensuring universality across various data types.






























§ IMPLICIT ADVERSARIAL DATA AUGMENTATION



We initially introduce a sample-wise adversarial data augmentation strategy to facilitate model training across various learning scenarios. By considering infinite augmentations, we then derive a surrogate loss for our augmentation strategy. 
















 §.§ Adversarial Data Augmentation



Consider training a deep classifier ℱ, with weights Φ on a training set, denoted as 𝒟^tr = {(x_i, y_i)}_i=1^N, where N refers to the number of training samples, and y_i∈{1,⋯,𝒞} represents the label of sample x_i. The deep feature (before logit) learned by ℱ for x_i is represented as a ℋ-dimensional vector h_i = ℱ_Φ(x_i)∈ℝ^ℋ.






Our augmentation strategy enhances samples within the deep feature space of DNNs. The perturbation vectors for the deep feature of each sample are randomly extracted from either its adversarial or anti-adversarial perturbation distributions. These distributions are modeled as multivariate normal distributions, 𝒩(δ_i, Σ_y_i), where δ_i refers to the sample perturbation, and Σ_y_i represents the class-specific covariance matrix estimated from the features of all training samples in class y_i. As samples undergo augmentation within the deep feature space,  perturbations should also be generated within this space, facilitating semantic alterations for training samples. Consequently, the perturbation vector δ_i for sample x_i is calculated as ϵ_i·sign(∇_ h_iℓ_i^CE), where sign(∇_h_iℓ_i^CE) signifies the gradient sign of the CE loss ℓ_i^CE with respect to h_i. The parameter ϵ_i plays a pivotal role in determining the perturbation strategy applied to x_i, encompassing both the perturbation direction and bound. Its positive or negative sign signifies adversarial or anti-adversarial perturbations, respectively. Furthermore, the absolute value |ϵ_i| governs the perturbation bound. In practical applications, the value of ϵ_i is dynamically computed through a perturbation network based on the training characteristics of x_i, which will be elaborated in Section <ref>. Additionally, the class-specific covariance matrix Σ_y_i within this distribution aids in preserving the covariance structure of each class. Its value is estimated in real-time by aggregating statistics from all mini-batches, as detailed in Section I of the Appendix. Regarding the augmentation strength quantified by the number of augmented instances ℳ_i for x_i, we define ℳ_i as ℳ/π_y_i, where ℳ is a constant and π_y_i represents the proportion of class y_i in the training data. Accordingly, a smaller proportion results in a larger number of augmented instances, ensuring class balance.


To compute the augmented features h̃_i from h_i, we transform h_i along random directions sampled from 
𝒩(δ_i,Σ_y_i). This transformation yields h̃_i∼𝒩(h_i+δ_i,αΣ_y_i), where the parameter α controls the extent of dispersion for augmented samples.
In summary, our adversarial data augmentation strategy offers the following advantages:








 
  * Instead of augmenting samples within the original data space, our approach enhances them within their adversarial and anti-adversarial perturbation distributions. This method effectively adjusts the learning difficulty distribution of training samples, 
    fostering improved generalization and robustness in DNNs. 

  * Our sample-wise augmentation distribution customizes the mean vector based on the unique training characteristics of each sample. This personalized strategy significantly enhances models' ability to address data biases, encompassing those beyond the category level.


   
     
    
    

    
   
    
    
    
    












 §.§ IADA Loss


With our augmentation strategy, a straightforward way to train a classifier involves augmenting each h_i for ℳ_i times. This procedure generates an augmented feature set for each sample, {h̃_i^1,⋯, h̃_i^ℳ_i}. Subsequently, the CE loss for all augmented samples is as follows:


    ℒ^ℳ(W,b)=1/ℳ̂∑_i=1^N∑_k=1^ℳ_i-loge^w_y_i^Th̃_i^k+b_y_i/∑_j=1^𝒞e^w_j^Th̃_i^k+b_j,

where ℳ̂=∑_i=1^Nℳ_i. Additionally, W=[w_1,⋯, w_𝒞]^T∈ℝ^𝒞×ℋ and b=[b_1,⋯, b_𝒞]^T∈ℝ^𝒞, in which w_j and b_j refer to the weight vector and bias corresponding to the last fully connected layer for class j. Considering augmenting more data while enhancing training efficiency, we explore augmenting an infinite number of times for the deep feature of each training sample. As ℳ in ℳ_i approaches infinity, the expected CE loss is expressed as:



    ℒ^ℳ→∞(W,b)
           =∑_i=1^N1/π_y_iE_h̃_i[-
        loge^w_y_i^Th̃_i+b_y_i/∑_j=1^𝒞e^w_j^Th̃_i+b_j].


However, accurately calculating Eq. (<ref>) poses a challenge. Hence, we proceed to derive a computationally efficient surrogate loss for it. Given the concavity of the logarithmic function log(·), using Jensen's inequality, E[log X]≤logE[X], we derive an upper bound of Eq. (<ref>) as follows:

    1!ℒ^ℳ→∞(W,b) ≤∑_i=1^N1/π_y_ilog(∑_j=1^𝒞E_h̃_i[e^Δw_j,y_ih̃_i+Δ b_j,y_i]),

where Δw_j,y_i=w_j^T-w_y_i^T and Δ b_j,y_i=b_j-b_y_i. 
As h̃_i is a Gaussian random variable adhering to 
𝒩(h_i+δ_i,αΣ_y_i), 
we know that Δw_j,y_ih̃_i+Δb_j,y_i∼𝒩(Δw_j,y_i(h_i+δ_i)+Δb_j,y_i, αΔw_j,y_iΣ_y_iΔw_j,y_i^T).








Subsequently, utilizing the moment-generating function,

    E[e^t X]=e^t μ+1/2σ^2 t^2,    X ∼𝒩(μ, σ^2),

the upper bound of Eq. (<ref>) can be represented as

    ℒ^ℳ→∞(W,b) ≤∑_i=1^N-1/π_y_iloge^𝒵_i^y_i/∑_j=1^𝒞e^𝒵_i^j,

where 𝒵_i^j = w_j(h_i+δ_i)+b_j+αρ_i^j and ρ_i^j=1/2Δw_j,y_iΣ_y_iΔw_j,y_i^T.





















































Drawing inspiration from the Logit Adjustment (LA) approach <cit.>, we introduce its logit adjustment term in place of the class-wise weight 1/π_y_i, providing a more effective solution for imbalanced class distributions. Consequently, the final IADA loss is formulated as follows:

    ℒ^IADA(W,b) ∑_i=1^N-loge^𝒵̃_i^y_i/∑_j=1^𝒞e^𝒵̃_i^j,





















where 𝒵̃_i^j = w_j(h_i+δ_i)+b_j+αρ_i^j+βlogπ_j. The symbols α and β serve as two hyperparameters in the IADA loss, frequently set to 0.5 and 1, respectively, in practical applications. 
The IADA loss, essentially a logit-adjusted variant of the CE loss, operates as a surrogacy for our proposed adversarial data augmentation strategy. 
Therefore, instead of explicitly executing the augmentation process, we can directly optimize this loss, thereby improving efficiency.









We further explain the IADA loss, defined in Eq. (<ref>), from a regularization perspective using the Taylor expansion. 
This process reveals three regularization terms stemming from our adversarial data augmentation strategy, as outlined in Table <ref>. A detailed analysis of these terms is presented in Section III of the Appendix. Through our analysis, the first term 𝒢 diminishes the mapped variances of deep features within each class, thereby enhancing intra-class compactness and improving the generalization ability of models. The second term ℛ reinforces model robustness by increasing the cosine similarity between the classification boundary and the gradient vectors of adversarial samples. Furthermore, the third term ℱ promotes fairness among classes by favoring less-represented categories. Collectively, the regularization terms incorporated in the IADA loss significantly contribute to strengthening the generalization, robustness, and inter-class fairness of DNNs, as depicted in Fig. <ref> (Box 2). 














§ OPTIMIZATION USING IADA LOSS






Due to the necessity of pre-determining the value of ϵ_i in δ_i, which governs the perturbation strategies, when utilizing the IADA loss, we construct a meta-learning-based framework named Meta-IADA. This framework is designed to optimize classifiers using the IADA loss. As illustrated in 
Fig. <ref> (Box 3), Meta-IADA comprises four main components: the classifier, the characteristics extraction module, the perturbation network, and the meta-learning-based learning strategy.


Considering that determining perturbation strategies for samples involves factors including their learning difficulty, class distribution, and noise levels <cit.>, we extract fifteen training characteristics (e.g., sample loss and margin) from the classifier to encompass these aspects. All characteristics are comprehensively introduced in Section IV of the Appendix. These extracted characteristics then serve as inputs to the perturbation network, assisting in computing the values of ϵ_i. Within our framework, the perturbation network employs a two-layer MLP[A comparative analysis of alternative architectures for the perturbation network is detailed in Section V of the Appendix.], known theoretically as a universal approximator for nearly any continuous function. Its output passes through a Tanh function to constrain the range of ϵ_i within (-1, 1).





















Meta-IADA employs a meta-learning-based strategy to iteratively update the classifier and the perturbation network. This involves leveraging a high-quality (clean and balanced) yet small meta dataset, 𝒟^meta={(x_i^meta,y_i^meta)}_i=1^M. Additionally, to mitigate the accuracy compromise within Σ_y_i for minor classes due to the constraints of limited training data, their values are further updated on the metadata. Let Ω represent the parameters of the perturbation network. The optimization process within Meta-IADA is detailed as follows:










Initially, the parameters of the classifier, Φ, are updated using stochastic gradient descent (SGD) on a mini-batch of training samples {(x_i,y_i)}_i=1^n with the following objective:



    1!Φ^t+1←Φ^t-η_11/n∑_i=1^n∇_Φℓ^IADA(ℱ(x_i;Φ^t),y_i; Σ^t_y_i,ϵ(f_i^t,Ω^t)),

where 

η_1 is the step size. Additionally, f_i^t denotes the concatenated vector containing the extracted training characteristics for x_i at the tth iteration. Subsequently, leveraging the optimized Φ^t+1, the parameter update in the perturbation network, Ω, entails utilizing a mini-batch of metadata {(x_i^meta,y_i^meta)}_i=1^m:

    1!Ω^t+1   ←Ω^t-η_21/m∑_i=1^m∇_Ωℓ^CE(ℱ(x_i^meta;Φ^t+1),y_i^meta),

where 

η_2 denotes the step size. Simultaneously, the optimization of covariance matrices is conducted using the metadata, outlined as follows:

    1!Σ^t+1   ←Σ^t-η_21/m∑_i=1^m∇_Σℓ^CE(ℱ(x_i^meta;Φ^t+1),y_i^meta).

Finally, leveraging the computed perturbations and updated covariance matrices, we proceed to update the parameters Φ of the classifier in the following manner:

    1!Φ^t+1   ←Φ^t-η_11/n∑_i=1^n∇_Φℓ^IADA(ℱ(x_i;Φ^t),y_i; Σ^t+1_y_i,ϵ(f_i^t,Ω^t+1)).

Similar to MetaAug <cit.>, to acquire better-generalized representations, the classifier is initially trained using vanilla CE loss, followed by trained with Meta-IADA. The algorithm for Meta-IADA is delineated in Algorithm <ref>.
























































§ EXPERIMENTS


We experiment across four typical biased learning scenarios, including LT learning, GLT learning, noisy label learning, and subpopulation shift learning, involving image and text datasets. The excluded settings and results (including those on standard datasets) are detailed in the Appendix. The code for Meta-IADA is available in the supplementary materials.







































































 §.§ Long-Tail Learning


Four LT image classification benchmarks, CIFAR-LT <cit.>, ImageNet-LT <cit.>, Places-LT <cit.>, and iNaturalist (iNat) 2018 <cit.>, are evaluated. Additionally, two imbalanced 
text classification datasets 
are included. Due to space limitations, we only present experiments for CIFAR-LT and iNat in the main text. 




  
Experiments on CIFAR-LT Datasets.
We employ the ResNet-32 model <cit.> with an initial learning rate of 0.1. The training employs the SGD optimizer with a momentum of 0.9 and a weight decay of 5×10^-4 on a single GPU, spanning 200 epochs. The learning rate is decayed by 0.01 at the 160th and 180th epochs. Additionally, the perturbation network is optimized using Adam, with an initial learning rate of 1×10^-3. To construct metadata, we randomly select ten images per class from the validation data. For the hyperparameters in the IADA loss, α is selected from {0.1, 0.25, 0.5, 0.75, 1}, while keeping β fixed at 1.  


From the results reported in Table <ref>, Meta-IADA displays remarkable superiority over other LT baselines, underscoring its effectiveness in managing imbalanced class distributions. Additionally, it outperforms previous implicit augmentation methods, providing evidence for the efficacy of augmenting samples within their adversarial and anti-adversarial perturbation distributions. Furthermore, as depicted in Fig. <ref>, Meta-IADA induces a lower proportion of adversarial samples in major classes (“C1" to “C5"), whereas minor classes (“C6" to “C10") exhibit a higher proportion. This manifests the model's increased attention on samples in tail classes. Comparative analyses of confusion matrices involving CE loss, MetaSAug, and Meta-IADA are presented in Section V of the Appendix. 
The results unveil that Meta-IADA remarkably increases the accuracy of both major and minor classes. Conversely, while MetaSAug improves the performance of minor categories, it compromises the accuracy of major classes.










  
Experiments on iNat 2018 Dataset.
The ResNet-50 model serves as the backbone classifier, pre-trained on ImageNet <cit.> and iNat 2017 <cit.> datasets. The perturbation network is optimized using Adam, with an initial learning rate of 1×10^-4. Other settings follow those outlined in the MetaSAug <cit.> paper. 
As reported in Table <ref>, Meta-IADA outperforms other comparative approaches tailored for LT learning. This suggests that, even in situations with imbalanced class distributions, employing a sample-level strategy proves more effective, as finer-grained imbalances within each class may also exist.






 











 §.§ Generalized Long-Tail Learning

GLT learning considers both long-tailed class and attribute distributions in the training data. We employ two GLT benchmarks, ImageNet-GLT, and MSCOCO-GLT <cit.>. Each benchmark comprises three protocols, CLT, ALT, and GLT, showcasing variations in class distribution, attribute distribution, and combinations of both between training and testing datasets. The ResNeXt-50 <cit.> model is utilized as the backbone network. We train models with a batch size of 256 and an initial learning rate of 0.1, using SGD with a weight decay of 5×10^-4 and a momentum of 0.9. The perturbation network is optimized using the Adam optimizer, initialized with a learning rate of 1×10^-3. The metadata utilized in this experiment is balanced in both classes and attributes. We adopt the construction method of Tang et al. r67, which involves clustering images in each class into six groups using KMeans with a pre-trained ResNet-50 model. Two images are then randomly selected from each group and class within the validation data.











The comparative results for ImageNet-GLT are outlined in Table <ref>, while those for MSCOCO-GLT are presented in the Appendix. Meta-IADA demonstrates substantial enhancements in accuracy and precision across all three protocols, emphasizing its ability to address distributional skewness in three scenarios, including attribute imbalance, class imbalance, and their combination. The efficacy of Meta-IADA stems from its ability to apply adversarial augmentation to samples from tail classes and those with rare attributes. This significantly magnifies the impact of these samples on model training, resulting in improved prediction accuracy. 

However, methods specifically designed for LT learning demonstrate subpar performance on the ALT protocol, primarily due to their class-level characteristics.













 §.§ Noisy Label Learning


We examine two types of label corruptions: uniform and pair-flip noise <cit.>, using CIFAR <cit.> datasets. The Wide ResNet-28-10 (WRN-28-10) <cit.> and ResNet-32 models are utilized for uniform and flip noises, respectively.
1,000 images with clean labels are selected from the validation set to compile the metadata. The ResNet settings match those used for CIFAR-LT. WRN-28-10 is trained using SGD with an initial learning rate of 0.1, a momentum of 0.9, and a weight decay of 5×10^-4; the learning rate is decayed by 0.1 at the 50th and 55th epochs during the total 60 epochs. The Adam optimizer, initialized with a learning rate of 1×10^-3, is utilized for optimizing the perturbation network.








Table <ref> presents the comparison results for flip noise, while those for uniform noise are detailed in the Appendix. Meta-IADA consistently achieves SOTA performance when compared to all other methods, surpassing the highest accuracy among comparative methods by an average of 2%.
These outcomes underscore its capacity to bolster DNNs' robustness against noise. An analysis of Fig. <ref> indicates that nearly all noisy samples undergo anti-adversarial augmentations in Meta-IADA, effectively mitigating the negative impact of noisy samples on the overall performance of DNNs.

































 §.§ Subpopulation Shift Learning


We conduct evaluations on four binary classification datasets characterized by subpopulation shifts: Colored MNIST (CMNIST) <cit.>, Waterbirds <cit.>, CelebA <cit.>, and CivilComments <cit.>. For three image datasets (i.e., CMNIST, Waterbirds, and CelebA), we utilize ResNet-50 <cit.> as the backbone network, while for the text dataset, CivilComments, we employ DistilBert <cit.>. To provide a comprehensive assessment, we report both average and worst-group accuracy. Detailed experimental settings and dataset introductions are available in Section V of the Appendix.

Based on the results in Table <ref>, Meta-IADA achieves the highest worst-group accuracy across the four datasets. This emphasizes its effectiveness in enhancing performance for underrepresented groups, such as samples in the landbird class with a water background. Typically, these samples benefit from 

adversarial augmentation, enhancing their influence on model training. Furthermore, except for the Waterbirds dataset, Meta-IADA surpasses other methods in terms of average accuracy. These findings illustrate Meta-IADA's capability to bolster model resilience against subpopulation shifts.









 §.§ Visualization Results




We utilize the visualization method introduced in ISDA <cit.>, projecting the features augmented by Meta-IADA back into the pixel space. The results, depicted in Fig. <ref>, highlight the diversity encapsulated within the generated adversarial and anti-adversarial samples. Additionally, samples created through adversarial and anti-adversarial augmentation commonly showcase varying levels of difficulty compared to the original samples. These modifications are attributed to transformations within the deep feature space, influenced by semantic vectors associated with attributes such as angles, colors, and backgrounds.












 §.§ Ablation and Sensitivity Studies



Ablation studies are conducted to analyze the impact of the three regularization terms within the IADA loss. The results reported in Table <ref>, emphasize the crucial roles played by both the generalization term 𝒢 and the robustness term ℛ. Additionally, in the context of an imbalanced scenario, the fairness term ℱ also demonstrates its significance. Furthermore, sensitivity tests are performed on the hyperparameters α and β, which respectively control the effects of 𝒢 and ℱ. As shown in Fig. <ref>, 
Meta-IADA achieves optimal performance when α is around 0.5 and β approaches 1. Besides, the stable ranges for α and β lie within [0.25, 0.75] and [0.75, 1.25], respectively. 
Based on these findings, we recommend setting α=0.5 and β=1 for practical applications. 













§ CONCLUSION

This paper presents a novel adversarial data augmentation strategy to facilitate model training across diverse learning scenarios, particularly those with data biases. This strategy enriches the deep features of samples by incorporating their adversarial and anti-adversarial perturbation distributions, dynamically adjusting the learning difficulty of training samples. Subsequently, we formulate a surrogate loss for our augmentation strategy and establish a meta-learning framework to optimize classifiers using this loss. Extensive experiments are conducted across various biased learning scenarios involving different networks and datasets, showcasing the effectiveness and broad applicability of our approach. 



































named


