In the realm of visual recognition, data augmentation stands out as a pivotal
technique to amplify model robustness. Yet, a considerable number of existing
methodologies lean heavily on heuristic foundations, rendering their intrinsic
mechanisms ambiguous. This manuscript takes both a theoretical and empirical
approach to understanding the phenomenon. Theoretically, we frame the discourse
around data augmentation within game theory's constructs. Venturing deeper, our
empirical evaluations dissect the intricate mechanisms of emblematic data
augmentation strategies, illuminating that these techniques primarily stimulate
mid- and high-order game interactions. Beyond the foundational exploration, our
experiments span multiple datasets and diverse augmentation techniques,
underscoring the universal applicability of our findings. Recognizing the vast
array of robustness metrics with intricate correlations, we unveil a
streamlined proxy. This proxy not only simplifies robustness assessment but
also offers invaluable insights, shedding light on the inherent dynamics of
model game interactions and their relation to overarching system robustness.
These insights provide a novel lens through which we can re-evaluate model
safety and robustness in visual recognition tasks.

在视觉识别领域，数据增强作为一种关键技术可以增加模型的鲁棒性。本文从理论和实证的角度探讨数据增强的机制，揭示了其在模型鲁棒性中的作用，并通过实验证明了这些技术主要通过中高级游戏交互来刺激。此外，我们的研究还涵盖了多个数据集和各种增强技术，强调了我们的发现在各种情况下的普适性。通过揭示一个简化的代理方法，我们不仅能简化鲁棒性评估，还能深入了解模型游戏交互的固有动态及其与整体系统鲁棒性的关系。这些洞察力为重新评估视觉识别任务中的模型安全性和鲁棒性提供了新的透视。

从鲁棒性视角理解数据增强

Understanding Data Augmentation from a Robustness Perspective

Federated learning (FL) is designed to preserve data privacy during model
training, where the data remains on the client side (i.e., IoT devices), and
only model updates of clients are shared iteratively for collaborative
learning. However, this process is vulnerable to privacy attacks and Byzantine
attacks: the local model updates shared throughout the FL network will leak
private information about the local training data, and they can also be
maliciously crafted by Byzantine attackers to disturb the learning. In this
paper, we propose a new FL scheme that guarantees rigorous privacy and
simultaneously enhances system robustness against Byzantine attacks. Our
approach introduces sparsification- and momentum-driven variance reduction into
the client-level differential privacy (DP) mechanism, to defend against
Byzantine attackers. The security design does not violate the privacy guarantee
of the client-level DP mechanism; hence, our approach achieves the same
client-level DP guarantee as the state-of-the-art. We conduct extensive
experiments on both IID and non-IID datasets and different tasks and evaluate
the performance of our approach against different Byzantine attacks by
comparing it with state-of-the-art defense methods. The results of our
experiments show the efficacy of our framework and demonstrate its ability to
improve system robustness against Byzantine attacks while achieving a strong
privacy guarantee.

提出了基于差分隐私机制的稀疏化和动量驱动的方差减少方法，以防御拜占庭攻击，并保证演算法的客户端隐私保障。通过与现有方法的比较实验证明了该框架提高了系统的强韧性，并取得了较强的隐私保证。