. However state-of-the-art vision models are still trained with supervised learning which requires a large corpus of labeled images to work well. By showing the models only labeled images, we limit ourselves from making use of unlabeled images available in much larger quantities to improve accuracy and robustness of state-of-the-art models.
Here we use unlabeled images to improve the state-of-the-art ImageNet accuracy and show that the accuracy gain has an outsized impact on robustness. For this purpose, we use a much larger corpus of unlabeled images, where some images may not belong to any category in ImageNet. We train our model using the self-training framework  which has three main steps: 1) train a teacher model on labeled images, 2) use the teacher to generate pseudo labels on unlabeled images, and 3) train a student model on the combination of labeled images and pseudo labeled images. Finally, we iterate the algorithm a few times by treating the student as a teacher to generate new pseudo labels and train a new student.
Our experiments show that an important element for this simple method to work well at scale is that the student model should be noised during its training while the teacher should not be noised during the generation of pseudo labels. This way, the pseudo labels are as good as possible, and the noised student is forced to learn harder from the pseudo labels. To noise the student, we use dropout , data augmentation  and stochastic depth  during its training. We call the method self-training with Noisy Student to emphasize the role that noise plays in the method and results. To achieve strong results on ImageNet, the student model also needs to be large, typically larger than common vision models, so that it can leverage a large number of unlabeled images.
Using self-training with Noisy Student, together with 300M unlabeled images, we improve EfficientNet’s  ImageNet top-1 accuracy to 87.4%. This accuracy is 1.0% better than the previous state-of-the-art ImageNet accuracy which requires 3.5B weakly labeled Instagram images. Not only our method improves standard ImageNet accuracy, it also improves classification robustness on much harder test sets by large margins: ImageNet-A  top-1 accuracy from 16.6% to 74.2%, ImageNet-C  mean corruption error (mCE) from 45.7 to 31.2 and ImageNet-P  mean flip rate (mFR) from 27.8 to 16.1. Our main results are shown in Table 1.
2 Self-training with Noisy Student
Algorithm 1 gives an overview of self-training with Noisy Student (or Noisy Student in short). The inputs to the algorithm are both labeled and unlabeled images. We use the labeled images to train a teacher model using the standard cross entropy loss. We then use the teacher model to generate pseudo labels on unlabeled images. The pseudo labels can be soft (a continuous distribution) or hard (a one-hot distribution). We then train a student model which minimizes the combined cross entropy loss on both labeled images and unlabeled images. Finally, we iterate the process by putting back the student as a teacher to generate new pseudo labels and train a new student.
The algorithm is basically self-training, a method in semi-supervised learning (e.g., [59, 79]). We will discuss how our method is related to prior works in Section 5. Our main change is to add more sources of noise to the student to significantly improve it while removing the noise in the teacher when the teacher generates the pseudo labels.
When the student model is deliberately noised it is actually trained to be consistent to the more powerful teacher model that is not noised when it generates pseudo labels. In our experiments, we use dropout , stochastic depth , data augmentation  to noise the student.
Although noise may appear to be limited and uninteresting, when it is applied to unlabeled data, it has a compound benefit of enforcing local smoothness in the decision function on both labeled and unlabeled data. Different kinds of noise, however, may have different effects. When data augmentation noise is used, the student must ensure that a translated image, for example, should have the same category with a non-translated image. This invariance constraint reduces the degrees of freedom in the model. When dropout and stochastic depth are used, the teacher model behaves like an ensemble of models (when it generates the pseudo labels, dropout is not used), whereas the student behaves like a single model. In other words, the student is forced to mimic a more powerful ensemble model.
The architectures for the student and teacher models can be the same or different. However an important requirement for Noisy Student to work well is that the student model needs to be sufficiently large to fit more data (labeled and pseudo labeled). For this purpose, we use the recently developed EfficientNet architectures  because they have a larger capacity than ResNet architectures . Secondly, to enable the student to learn a more powerful model, we also make the student model larger than the teacher model. This is an important difference between our work and prior works on teacher-student framework whose main goal is model compression.
We find that Noisy Student is better with an additional trick: data balancing. Specifically, as all classes in ImageNet have a similar number of labeled images, we also need to balance the number of unlabeled images for each class. We duplicate images in classes where there are not enough images. For classes where we have too many images, we take the images with the highest confidence.
Finally, in the above, we say that the pseudo labels can be soft or hard. In our experiments, we observe that soft pseudo labels are usually more stable and lead to faster convergence, especially when the teacher model has low accuracy. Hence we use soft pseudo labels for our experiments unless otherwise specified.
In the following, we will first describe experiment details to achieve our results. We will then show our results on ImageNet and compare them with state-of-the-art models. Lastly, we will show the results of benchmarking our model on robustness datasets such as ImageNet-A, C and P and adversarial robustness.
3.1 Experiment Details
We obtain unlabeled images from the JFT dataset [26, 11], which has around 300M images. Although the images in the dataset have labels, we ignore the labels and treat them as unlabeled data. We used the version from , which filtered the validation set of ImageNet.
We then perform data filtering and balancing on this corpus. First, we run an EfficientNet-B0 trained on ImageNet 
over the JFT dataset to predict a label for each image. We then select images that have confidence of the label higher than 0.3. For each class, we select at most 130K images that have the highest confidence. Finally, for classes that have less than 130K images, we duplicate some images at random so that each class can have 130K images. Hence the total number of images that we use for training a student model is 130M (with some duplicated images). Due to duplications, there are only 81M unique images among these 130M images. We do not tune these hyperparameters extensively since our method is highly robust to them.
We use EfficientNets  as our baseline models because they provide better capacity for more data. In our experiments, we also further scale up EfficientNet-B7 and obtain EfficientNet-L0, L1 and L2. EfficientNet-L0 is wider and deeper than EfficientNet-B7 but uses a lower resolution, which gives it more parameters to fit a large number of unlabeled images with similar training speed. Then, EfficientNet-L1 is scaled up from EfficientNet-L0 by increasing width. Lastly, we follow the idea of compound scaling  and scale all dimensions to obtain EfficientNet-L2. Due to the large model size, the training time of EfficientNet-L2 is approximately five times the training time of EfficientNet-B7. For more information about the large architectures, please refer to Table 7 in Appendix A.1.
For labeled images, we use a batch size of 2048 by default and reduce the batch size when we could not fit the model into the memory. We find that using a batch size of 512, 1024, and 2048 leads to the same performance. We determine number of training steps and the learning rate schedule by the batch size for labeled images. Specifically, we train the student model for 350 epochs for models larger than EfficientNet-B4, including EfficientNet-L0, L1 and L2 and train the student model for 700 epochs for smaller models. The learning rate starts at 0.128 for labeled batch size 2048 and decays by 0.97 every 2.4 epochs if trained for 350 epochs or every 4.8 epochs if trained for 700 epochs.
For unlabeled images, we set the batch size to be three times the batch size of labeled images for large models, including EfficientNet-B7, L0, L1 and L2. For smaller models, we set the batch size of unlabeled images to be the same as the batch size of labeled images. In our implementation, labeled images and unlabeled images are concatenated together and we compute the average cross entropy loss.
Lastly, we apply the recently proposed technique to fix train-test resolution discrepancy  for EfficientNet-L0, L1 and L2. In particular, we first perform normal training with a smaller resolution for 350 epochs. Then we finetune the model with a larger resolution for 1.5 epochs on unaugmented labeled images. Similar to , we fix the shallow layers during finetuning.
Our largest model, EfficientNet-L2, needs to be trained for 3.5 days on a Cloud TPU v3 Pod, which has 2048 cores.
to noise the student. The hyperparameters for these noise functions are the same for EfficientNet-B7, L0, L1 and L2. In particular, we set the survival probability in stochastic depth to 0.8 for the final layer and follow the linear decay rule for other layers. We apply dropout to the final classification layer with a dropout rate of 0.5. For RandAugment, we apply two random operations with the magnitude set to 27.
The best model in our experiments is a result of iterative training of teacher and student by putting back the student as the new teacher to generate new pseudo labels. During this process, we kept increasing the size of the student model to improve the performance. Our procedure went as follows. We first improved the accuracy of EfficientNet-B7 using EfficientNet-B7 as both the teacher and the student. Then by using the improved B7 model as the teacher, we trained an EfficientNet-L0 student model. Next, with the EfficientNet-L0 as the teacher, we trained a student model EfficientNet-L1, a wider model than L0. Afterward, we further increased the student model size to EfficientNet-L2, with the EfficientNet-L1 as the teacher. Lastly, we trained another EfficientNet-L2 student by using the EfficientNet-L2 model as the teacher.
|Method||# Params||Extra Data||Top-1 Acc.||Top-5 Acc.|
|ResNet-50 Billion-scale ||26M||3.5B images labeled with tags||81.2%||96.0%|
|ResNeXt-101 Billion-scale ||193M||84.8%||-|
|ResNeXt-101 WSL ||829M||85.4%||97.6%|
|FixRes ResNeXt-101 WSL ||829M||86.4%||98.0%|
|Noisy Student (L2)||480M||300M unlabeled images||87.4%||98.2%|
3.2 ImageNet Results
We first report the validation set accuracy on the ImageNet 2012 ILSVRC challenge prediction task as commonly done in literature [35, 66, 23, 69] (see also ). As shown in Table 2, Noisy Student with EfficientNet-L2 achieves 87.4% top-1 accuracy which is significantly better than the best previously reported accuracy on EfficientNet of 85.0%. The total gain of 2.4% comes from two sources: by making the model larger (+0.5%) and by Noisy Student (+1.9%). In other words, using Noisy Student makes a much larger impact to the accuracy than changing the architecture.
Further, Noisy Student outperforms the state-of-the-art accuracy of 86.4% by FixRes ResNeXt-101 WSL [44, 71] that requires 3.5 Billion Instagram images labeled with tags. As a comparison, our method only requires 300M unlabeled images, which is perhaps more easy to collect. Our model is also approximately twice as small in the number of parameters compared to FixRes ResNeXt-101 WSL.
Model size study: Noisy Student for EfficientNet B0-B7 without Iterative Training.
In addition to improving state-of-the-art results, we conduct additional experiments to verify if Noisy Student can benefit other EfficienetNet models. In the above experiments, iterative training was used to optimize the accuracy of EfficientNet-L2 but here we skip it as it is difficult to use iterative training for many experiments. We vary the model size from EfficientNet-B0 to EfficientNet-B7  and use the same model as both the teacher and the student. We apply RandAugment to all EfficientNet baselines, leading to more competitive baselines. As shown in Figure 1, Noisy Student leads to a consistent improvement of around 0.8% for all model sizes. Overall, EfficientNets with Noisy Student provide a much better tradeoff between model size and accuracy when compared with prior works. The results also confirm that vision models can benefit from Noisy Student even without iterative training.
3.3 Robustness Results on ImageNet-A, ImageNet-C and ImageNet-P
We evaluate the best model, that achieves 87.4% top-1 accuracy, on three robustness test sets: ImageNet-A, ImageNet-C and ImageNet-P. ImageNet-C and P test sets  include images with common corruptions and perturbations such as blurring, fogging, rotation and scaling. ImageNet-A test set  consists of difficult images that cause significant drops in accuracy to state-of-the-art models. These test sets are considered as “robustness” benchmarks because the test images are either much harder, for ImageNet-A, or the test images are different from the training images, for ImageNet-C and P.
For ImageNet-C and ImageNet-P, we evaluate our models on two released versions with resolution 224x224 and 299x299 and resize images to the resolution EfficientNet is trained on.
|Method||Top-1 Acc.||Top-5 Acc.|
|ResNeXt-101  (32x4d)||5.9%||-|
|ResNeXt-101  (64x4d)||7.3%||-|
|ResNeXt-101+SE  (32x4d)||14.2%||-|
|ResNeXt-101 WSL [44, 48]||16.6%||-|
|Noisy Student (L2)||74.2%||91.3%|
|Patch Guassian ||299||52.3%||60.4|
|ResNeXt-101 WSL [44, 48]||224||-||45.7|
|Noisy Student (L2)||224||72.8%||34.7|
|Noisy Student (L2)||299||75.5%||31.2|
|Low Pass Filter Pooling ||224||-||51.2|
|ResNeXt-101 WSL [44, 48]||224||-||27.8|
|Noisy Student (L2)||224||83.1%||17.8|
|Noisy Student (L2)||299||84.3%||16.1|
As shown in Table 3, 4 and 5, when compared with the previous state-of-the-art model ResNeXt-101 WSL [44, 48] trained on 3.5B weakly labeled images, Noisy Student yields substantial gains on robustness datasets. On ImageNet-C, it reduces mean corruption error (mCE) from 45.7 to 31.2. On ImageNet-P, it leads to an mean flip rate (mFR) of 17.8 if we use a resolution of 224x224 (direct comparison) and 16.1 if we use a resolution of 299x299.111For EfficientNet-L2, we use the model without finetuning with a larger test time resolution, since a larger resolution results in a discrepancy with the resolution of data and leads to degraded performance on ImageNet-C and ImageNet-P. These significant gains in robustness in ImageNet-C and ImageNet-P are surprising because our models were not deliberately optimizing for robustness (e.g., via data augmentation).
The biggest gain is observed on ImageNet-A: our method achieves 3.5x higher accuracy on ImageNet-A, going from 16.6% of the previous state-of-the-art to 74.2% top-1 accuracy. In contrast, changing architectures or training with weakly labeled data give modest gains in accuracy from 4.7% to 16.6%.
To intuitively understand the significant improvements on the three robustness benchmarks, we show several images in Figure 2 where the predictions of the standard model are incorrect and the predictions of the Noisy Student model are correct.
Figure 1(a) shows example images from ImageNet-A and the predictions of our models. The model with Noisy Student can successfully predict the correct labels of these highly difficult images. For example, without Noisy Student, the model predicts bullfrog for the image shown on the left of the second row, which might be resulted from the black lotus leaf on the water. With Noisy Student, the model correctly predicts dragonfly for the image. At the top-left image, the model without Noisy Student ignores the sea lions and mistakenly recognizes a buoy as a lighthouse, while the model with Noisy Student can recognize the sea lions.
Figure 1(b) shows images from ImageNet-C and the corresponding predictions. As can be seen from the figure, our model with Noisy Student makes correct predictions for images under severe corruptions and perturbations such as snow, motion blur and fog, while the model without Noisy Student suffers greatly under these conditions. The most interesting image is shown on the right of the first row. The swing in the picture is barely recognizable by human while the Noisy Student model still makes the correct prediction.
Figure 1(c) shows images from ImageNet-P and the corresponding predictions. As can be seen, our model with Noisy Student makes correct and consistent predictions as images undergone different perturbations while the model without Noisy Student flips predictions frequently. For instance, on the right column, as the image of the car undergone a small rotation, the standard model changes its prediction from racing car to car wheel to fire engine. In contrast, the predictions of the model with Noisy Student remain quite stable.
3.4 Adversarial Robustness Results
After testing our model’s robustness to common corruptions and perturbations, we also study its performance on adversarial perturbations. We evaluate our EfficientNet-L2 models with and without Noisy Student against an FGSM attack. This attack performs one gradient descent step on the input image  with the update on each pixel set to . As shown in Figure 3, Noisy Student leads to approximately 10% improvement in accuracy even though the model is not optimized for adversarial robustness.
Note that these adversarial robustness results are not directly comparable to prior works since we use a large input resolution of 800x800 and adversarial vulnerability can scale with the input dimension [17, 20, 19, 61]. Probably due to the same reason, at , EfficientNet-L2 achieves an accuracy of 1.1% under a stronger attack PGD with 10 iterations , which is far from the SOTA results. Noisy Student can still improve the accuracy to 1.6%.
4 Ablation Study: The Importance of Noise in Self-training
In this section, we study the importance of noise and the effect of several noise methods used in our model. Since we use soft pseudo labels generated from the teacher model, when the student is trained to be exactly the same as the teacher model, the cross entropy loss on unlabeled data would be zero and the training signal would vanish. Hence, a question that naturally arises is why the student can outperform the teacher with soft pseudo labels. As stated earlier, we hypothesize that noising the student is needed so that it does not merely learn the teacher’s knowledge. We investigate the importance of noising in two scenarios with different amounts of unlabeled data and different teacher model accuracies. In both cases, we gradually remove augmentation, stochastic depth and dropout for unlabeled images, while keeping them for labeled images. This way, we can isolate the influence of noising on unlabeled images from the influence of preventing overfitting for labeled images.
|Model / Unlabeled Set Size||1.3M||130M|
|Noisy Student (B5)||83.9%||84.9%|
|w/o Aug, SD, Dropout||83.2%||84.3%|
Here we show the evidence in Table 6, noise such as stochastic depth, dropout and data augmentation plays an important role in enabling the student model to perform better than the teacher. The performance consistently drops with noise function removed. For example, with all noise removed, the accuracy drops from 84.9% to 84.3% in the case with 130M unlabeled images and drops from 83.9% to 83.2% in the case with 1.3M unlabeled images. However, in the case with 130M unlabeled images, with noise function removed, the performance is still improved to 84.3% from 84.0% when compared to the supervised baseline. We hypothesize that the improvement can be attributed to SGD, which introduces stochasticity into the training process.
One might argue that the improvements from using noise can be resulted from preventing overfitting the pseudo labels on the unlabeled images. We verify that this is not the case when we use 130M unlabeled images since the model does not overfit the unlabeled set from the training loss. While removing noise leads to a much lower training loss for labeled images, we observe that, for unlabeled images, removing noise leads to a smaller drop in training loss. This is probably because it is harder to overfit the large unlabeled dataset.
5 Related works
Our work is based on self-training (e.g., [59, 79, 56]). Self-training first uses labeled data to train a good teacher model, then use the teacher model to label unlabeled data and finally use the labeled data and unlabeled data to jointly train a student model. In typical self-training with the teacher-student framework, noise injection to the student is not used by default, or the role of noise is not fully understood or justified. The main difference between our work and prior works is that we identify the importance of noise, and aggressively inject noise to make the student better.
Self-training was previously used to improve ResNet-50 from 76.4% to 81.2% top-1 accuracy  which is still far from the state-of-the-art accuracy. They did not show significant improvements in terms of robustness on ImageNet-A, C and P as we did. In terms of methodology, Yalniz et al.  also proposed to first only train on unlabeled images and then finetune their model on labeled images as the final stage. In Noisy Student, we combine these two steps into one because it simplifies the algorithm and leads to better performance in our preliminary experiments.
Also related to our work is Data Distillation , which ensembled predictions for an image with different transformations to teach a student network. The main difference between Data Distillation and our method is that we use the noise to weaken the student, which is the opposite of their approach of strengthening the teacher by ensembling.
Parthasarathi et al.  used knowledge distillation on unlabeled data to teach a small student model for speech recognition. Their main goal is to find a small and fast model for deployment. As noise injection methods are not used in the student model, and the student model was also small, it is more difficult to make the student better than teacher.
Chowdhury et al.  used self-training for domain adaptation. Their purpose is different from ours: to adapt a teacher model on one domain to another. Their noise model is video specific and not relevant for image classification. Their framework is highly optimized for videos, e.g., prediction on which frame to use in a video, which is not as general as our work.
Apart from self-training, another important line of work in semi-supervised learning [9, 85] is based on consistency training [6, 4, 53, 36, 70, 45, 41, 51, 10, 12, 49, 2, 38, 72, 74, 5, 81]. These works constrain model predictions to be invariant to noise injected to the input, hidden states or model parameters. Although they have produced promising results, in our preliminary experiments, consistency regularization works less well on ImageNet because consistency regularization in the early phase of ImageNet training regularizes the model towards high entropy predictions, and prevents it from achieving good accuracy. A common workaround is to use entropy minimization or ramp up the consistency loss. However, the additional hyperparameters introduced by the ramping up schedule and the entropy minimization make them more difficult to use at scale. Compared to consistency training [45, 5, 74], the self-training / teacher-student framework is better suited for ImageNet because we can train a good teacher on ImageNet using label data.
Works based on pseudo label [37, 31, 60, 1] are similar to self-training, but also suffers the same problem with consistency training, since it relies on a model being trained instead of a converged model with high accuracy to generate pseudo labels. Finally, frameworks in semi-supervised learning also include graph-based methods [84, 73, 77, 33], methods that make use of latent variables as target variables [32, 42, 78] and methods based on low-density separation [21, 58, 15], which might provide complementary benefits to our method.
As we use soft targets, our work is also related to methods in Knowledge Distillation [7, 3, 26, 16]. The main use case of knowledge distillation is model compression by making the student model smaller. The main difference between our method and knowledge distillation is that knowledge distillation does not consider unlabeled data and does not aim to improve the student model.
, have shown that computer vision models lack robustness. In other words, small changes in the input image can cause large changes to the predictions. Addressing the lack of robustness has become an important research direction in machine learning and computer vision in recent years.
Our study shows that using unlabeled data improves accuracy and general robustness. Our finding is consistent with similar arguments that using unlabeled data can improve adversarial robustness [8, 64, 46, 80]. The main difference between our work and these works is that they directly optimize adversarial robustness on unlabeled data, whereas we show that self-training with Noisy Student improves robustness greatly even without directly optimizing robustness.
Prior works on weakly-supervised learning require billions of weakly labeled data to improve state-of-the-art ImageNet models. In this work, we showed that it is possible to use unlabeled images to significantly advance both accuracy and robustness of state-of-the-art ImageNet models. We found that self-training is a simple and effective algorithm to leverage unlabeled data at scale. We improved it by adding noise to the student to learn beyond the teacher’s knowledge. The method, named self-training with Noisy Student, also benefits from the large capacity of EfficientNet family.
Our experiments showed that self-training with Noisy Student and EfficientNet can achieve an accuracy of 87.4% which is 1.9% higher than without Noisy Student. This result is also a new state-of-the-art and 1% better than the previous best method that used an order of magnitude more weakly labeled data [44, 71].
An important contribution of our work was to show that Noisy Student can potentially help addressing the lack of robustness in computer vision models. Our experiments showed that our model significantly improves accuracy on ImageNet-A, C and P without the need for deliberate data augmentation. For instance, on ImageNet-A, Noisy Student achieves 74.2% top-1 accuracy which is approximately 57% more accurate than the previous state-of-the-art model.
We thank the Google Brain team, Zihang Dai, Jeff Dean, Hieu Pham, Colin Raffel, Ilya Sutskever and Mingxing Tan for insightful discussions, Cihang Xie for robustness evaluation, Guokun Lai, Jiquan Ngiam, Jiateng Xie and Adams Wei Yu for feedbacks on the draft, Yanping Huang and Sameer Kumar for improving TPU implementation, Ekin Dogus Cubuk and Barret Zoph for help with RandAugment, Yanan Bao, Zheyun Feng and Daiyi Peng for help with the JFT dataset, Olga Wichrowska and Ola Spyra for help with infrastructure.
-  (2019) Pseudo-labeling and confirmation bias in deep semi-supervised learning. arXiv preprint arXiv:1908.02983. Cited by: §5.
-  (2018) There are many consistent explanations of unlabeled data: why you should average. In International Conference on Learning Representations, Cited by: §5.
-  (2014) Do deep nets really need to be deep?. In Advances in Neural Information Processing Systems, pp. 2654–2662. Cited by: §5.
-  (2014) Learning with pseudo-ensembles. In Advances in Neural Information Processing Systems, pp. 3365–3373. Cited by: §5.
-  (2019) MixMatch: a holistic approach to semi-supervised learning. In Advances in Neural Information Processing Systems, Cited by: §5.
Combining labeled and unlabeled data with co-training.
Proceedings of the eleventh annual conference on Computational learning theory, pp. 92–100. Cited by: §5.
-  (2006) Model compression. In Proceedings of the 12th ACM SIGKDD international conference on Knowledge discovery and data mining, pp. 535–541. Cited by: §5.
-  (2019) Unlabeled data improves adversarial robustness. arXiv preprint arXiv:1905.13736. Cited by: §5.
Semi-supervised learning (chapelle, o. et al., eds.; 2006)[book reviews].
IEEE Transactions on Neural Networks20 (3), pp. 542–542. Cited by: §5.
-  (2018) Semi-supervised deep learning with memory. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 268–283. Cited by: §5.
Xception: deep learning with depthwise separable convolutions.
Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1251–1258. Cited by: §3.1, Table 2.
Semi-supervised sequence modeling with cross-view training.
Empirical Methods in Natural Language Processing (EMNLP), Cited by: §5.
-  (2018) AutoAugment: learning augmentation strategies from data. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Cited by: Table 2.
-  (2019) RandAugment: practical data augmentation with no separate search. arXiv preprint arXiv:1909.13719. Cited by: §1, §2, §3.1.
-  (2017) Good semi-supervised learning that requires a bad gan. In Advances in Neural Information Processing Systems, pp. 6510–6520. Cited by: §5.
-  (2018) Born again neural networks. arXiv preprint arXiv:1805.04770. Cited by: §5.
-  (2019) Batch normalization is a cause of adversarial vulnerability. arXiv preprint arXiv:1905.02161. Cited by: §3.4.
-  (2019) ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness. In International Conference on Learning Representations, Cited by: Table 4.
-  (2018) Adversarial spheres. arXiv preprint arXiv:1801.02774. Cited by: §3.4.
-  (2015) Explaining and harnessing adversarial examples. In International Conference on Learning Representations, Cited by: §3.4, §3.4.
-  (2005) Semi-supervised learning by entropy minimization. In Advances in neural information processing systems, pp. 529–536. Cited by: §5.
-  (2019) Using videos to evaluate image model robustness. In ICLR Workshop, Cited by: §5.
-  (2016) Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770–778. Cited by: §1, §2, §3.2, Table 2.
-  (2019) Benchmarking neural network robustness to common corruptions and perturbations. In International Conference on Learning Representations, Cited by: §A.5, §A.5, §1, §3.3, Table 4, Table 5, §5.
-  (2019) Natural adversarial examples. arXiv preprint arXiv:1907.07174. Cited by: §1, §3.3, Table 3.
-  (2015) Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531. Cited by: §3.1, §5.
-  (2018) Squeeze-and-excitation networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 7132–7141. Cited by: Table 2.
-  (2017) Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4700–4708. Cited by: Table 2.
-  (2016) Deep networks with stochastic depth. In European conference on computer vision, pp. 646–661. Cited by: §1, §2, §3.1.
-  (2019) GPipe: efficient training of giant neural networks using pipeline parallelism. In Advances in Neural Information Processing Systems, Cited by: Table 2.
-  (2019) Label propagation for deep semi-supervised learning. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 5070–5079. Cited by: §5.
-  (2014) Semi-supervised learning with deep generative models. In Advances in neural information processing systems, pp. 3581–3589. Cited by: §5.
-  (2016) Semi-supervised classification with graph convolutional networks. arXiv preprint arXiv:1609.02907. Cited by: §5.
-  (2019) Do better imagenet models transfer better?. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2661–2671. Cited by: §3.1.
Imagenet classification with deep convolutional neural networks. In Advances in Neural Information Processing Systems, pp. 1097–1105. Cited by: §1, §3.2.
-  (2017) Temporal ensembling for semi-supervised learning. In International Conference on Learning Representations, Cited by: §5.
-  (2013) Pseudo-label: the simple and efficient semi-supervised learning method for deep neural networks. In Workshop on Challenges in Representation Learning, ICML, Vol. 3, pp. 2. Cited by: §5.
-  (2019) Certainty-driven consistency loss for semi-supervised learning. arXiv preprint arXiv:1901.05657. Cited by: §5.
-  (2018) Progressive neural architecture search. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 19–34. Cited by: Table 2.
-  (2019) Improving robustness without sacrificing accuracy with patch gaussian augmentation. arXiv preprint arXiv:1906.02611. Cited by: Table 4.
-  (2018) Smooth neighbors on teacher graphs for semi-supervised learning. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 8896–8905. Cited by: §5.
-  (2016) Auxiliary deep generative models. arXiv preprint arXiv:1602.05473. Cited by: §5.
-  (2018) Towards deep learning models resistant to adversarial attacks. International Conference on Learning Representations. Cited by: §3.4.
-  (2018) Exploring the limits of weakly supervised pretraining. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 181–196. Cited by: Table 1, §3.2, §3.3, Table 2, Table 3, Table 4, Table 5, §6.
-  (2018) Virtual adversarial training: a regularization method for supervised and semi-supervised learning. IEEE transactions on pattern analysis and machine intelligence. Cited by: §5.
-  (2019) Robustness to adversarial perturbations in learning from incomplete data. In Advances in Neural Information Processing Systems, Cited by: §5.
Domain adaptive transfer learning with specialist models. arXiv preprint arXiv:1811.07056. Cited by: §3.1.
-  (2019) Robustness properties of facebook’s resnext wsl models. arXiv preprint arXiv:1907.07640. Cited by: §3.3, Table 3, Table 4, Table 5.
Adversarial dropout for supervised and semi-supervised learning.
Thirty-Second AAAI Conference on Artificial Intelligence, Cited by: §5.
-  (2019) Lessons from building acoustic models with a million hours of speech. In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 6670–6674. Cited by: §5.
-  (2018) Deep co-training for semi-supervised image recognition. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 135–152. Cited by: §5.
-  (2018) Data distillation: towards omni-supervised learning. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4119–4128. Cited by: §5.
-  (2015) Semi-supervised learning with ladder networks. In Advances in neural information processing systems, pp. 3546–3554. Cited by: §5.
Regularized evolution for image classifier architecture search. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 33, pp. 4780–4789. Cited by: Table 2.
-  (2019) Do imagenet classifiers generalize to imagenet?. International Conference on Machine Learning. Cited by: §3.1, §3.2, §5.
-  (2003) Learning extraction patterns for subjective expressions. In Proceedings of the 2003 conference on Empirical methods in natural language processing, pp. 105–112. Cited by: §5.
-  (2019) Automatic adaptation of object detectors to new domains using self-training. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Cited by: §5.
-  (2016) Improved techniques for training gans. In Advances in neural information processing systems, pp. 2234–2242. Cited by: §5.
-  (1965) Probability of error of some adaptive pattern-recognition machines. IEEE Transactions on Information Theory 11 (3), pp. 363–371. Cited by: §1, §2, §5.
-  (2018) Transductive semi-supervised deep learning using min-max features. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 299–315. Cited by: §5.
-  (2019) First-order adversarial vulnerability of neural networks and input dimension. In International Conference on Machine Learning, pp. 5809–5817. Cited by: §3.4.
-  (2015) Very deep convolutional networks for large-scale image recognition. In International Conference on Learning Representations, Cited by: §1.
-  (2014) Dropout: a simple way to prevent neural networks from overfitting. The journal of machine learning research 15 (1), pp. 1929–1958. Cited by: §1, §2, §3.1.
-  (2019) Are labels required for improving adversarial robustness?. arXiv preprint arXiv:1905.13725. Cited by: §5.
Inception-v4, inception-resnet and the impact of residual connections on learning. In Thirty-First AAAI Conference on Artificial Intelligence, Cited by: Table 2.
-  (2015) Going deeper with convolutions. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1–9. Cited by: §1, §3.2.
-  (2016) Rethinking the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2818–2826. Cited by: Table 2.
-  (2013) Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199. Cited by: §5.
-  (2019) EfficientNet: rethinking model scaling for convolutional neural networks. In International Conference on Machine Learning, Cited by: Table 7, §1, §1, §2, §3.1, §3.1, §3.2, §3.2, Table 2.
-  (2017) Mean teachers are better role models: weight-averaged consistency targets improve semi-supervised deep learning results. In Advances in Neural Information Processing Systems, pp. 1195–1204. Cited by: §5.
-  (2019) Fixing the train-test resolution discrepancy. arXiv preprint arXiv:1906.06423. Cited by: Table 1, §3.1, §3.2, Table 2, §6.
-  (2019) Interpolation consistency training for semi-supervised learning. In Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence (IJCAI-19), Cited by: §5.
-  (2012) Deep learning via semi-supervised embedding. In Neural Networks: Tricks of the Trade, pp. 639–655. Cited by: §5.
-  (2019) Unsupervised data augmentation for consistency training. arXiv preprint arXiv:1904.12848. Cited by: §5.
-  (2017) Aggregated residual transformations for deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1492–1500. Cited by: Table 2.
-  (2019) Billion-scale semi-supervised learning for image classification. Arxiv 1905.00546. Cited by: Table 2, §5.
-  (2016) Revisiting semi-supervised learning with graph embeddings. arXiv preprint arXiv:1603.08861. Cited by: §5.
-  (2017) Semi-supervised qa with generative domain-adaptive nets. arXiv preprint arXiv:1702.02206. Cited by: §5.
-  (1995) Unsupervised word sense disambiguation rivaling supervised methods. In 33rd annual meeting of the association for computational linguistics, pp. 189–196. Cited by: §2, §5.
-  (2019) Adversarially robust generalization just requires more unlabeled data. arXiv preprint arXiv:1906.00555. Cited by: §5.
-  (2019) SL: self-supervised semi-supervised learning. In Proceedings of the IEEE international conference on computer vision, Cited by: §5.
-  (2019) Making convolutional networks shift-invariant again. In International Conference on Machine Learning, Cited by: Table 5.
-  (2017) Polynet: a pursuit of structural diversity in very deep networks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 718–726. Cited by: Table 2.
-  (2003) Semi-supervised learning using gaussian fields and harmonic functions. In Proceedings of the 20th International conference on Machine learning (ICML-03), pp. 912–919. Cited by: §5.
-  (2005) Semi-supervised learning literature survey. Technical report University of Wisconsin-Madison Department of Computer Sciences. Cited by: §5.
-  (2018) Learning transferable architectures for scalable image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 8697–8710. Cited by: Table 2.
Appendix A Experiments
a.1 Architecture Details
The architecture specifications of EfficientNet-L0, L1 and L2 are listed in Table 7. We also list EfficientNet-B7 as a reference. Scaling width and resolution by leads to times training time and scaling depth by leads to times training time. Hence, EfficientNet-L0 has around the same training speed with EfficientNet-B7 but more parameters that give it a larger capacity. EfficientNet-L1 approximately doubles the training time of EfficientNet-L0. Finally, the training time of EfficientNet-L2 is around times the training time of EfficientNet-L1.
|Architecture name||Train Res.||Test Res.||# Params|
a.2 Study on Using Out-of-domain Data
Unlike previous studies in semi-supervised learning that use in-domain unlabeled data (e.g
., CIFAR-10 images as unlabeled data for a small CIFAR-10 training set), to improve ImageNet, we must use out-of-domain unlabeled data. Here we study how to effectively use out-of-domain data. Since a teacher model’s confidence on an image can be a good indicator of whether it is an out-of-domain image, we consider the high-confidence images as in-domain images and the low-confidence images as out-of-domain images. We sample 1.3M images in confidence intervals.
We use EfficientNet-B0 as both the teacher model and the student model and compare using Noisy Student with soft pseudo labels and hard pseudo labels. The results are shown in Figure 4 with the following observations: (1) Soft pseudo labels and hard pseudo labels can both lead to great improvements with in-domain unlabeled images i.e., high-confidence images. (2) With out-of-domain unlabeled images, hard pseudo labels can hurt the performance while soft pseudo labels leads to robust performance.
We have also observed that using hard pseudo labels can achieve as good results or slightly better results when a larger teacher is used. Hence, whether soft pseudo labels or hard pseudo labels work better might need to be determined on a case-by-case basis.
a.3 Study on Unlabeled Data Size
We also study the effects of using different amounts of unlabeled data. We start with the 130M unlabeled images and gradually reduce the number of images. For simplicity, we experiment with using of the whole data by uniformly sampling images from the the unlabeled set though taking the images with highest confidence leads to better results. We use EfficientNet-B4 as both the teacher and the student. As can be seen from Table 8, the performance stays similar when we reduce the data to of the total data, which amounts to 8.1M images after duplicating. The performance drops when we further reduce it. Whether the model benefits from more unlabeled data depends on the capacity of the model since a small model can easily saturate, while a larger model can benefit from more data.
a.4 Study on Teacher Model’s Capacity
In all previous experiments, the student’s capacity is as large as or larger than the capacity of the teacher model. Here we study if it is possible to improve performance on small models by using a larger teacher model, since small models are useful when there are constraints for model size and latency in real-world applications. We use our best model Noisy Student with EfficientNet-L2 to teach student models with sizes ranging from EfficientNet-B0 to EfficientNet-B7. Iterative training is not used here for simplicity. We use the standard augmentation instead of RandAugment in this experiment.
The comparison is shown in Table 9. Using Noisy Student (EfficientNet-L2) as the teacher leads to another 0.8% improvement on top of the improved results. Notably, EfficientNet-B7 achieves an accuracy of 86.8%, which is 1.8% better than the supervised model. This shows that it is helpful to train a large model with high accuracy using Noisy Student when small models are needed for deployment.
|Model||# Params||Top-1 Acc.||Top-5 Acc.|
|Noisy Student (B0)||78.1||94.2|
|Noisy Student (B0, L2)||79.0||94.6|
|Noisy Student (B1)||80.3||95.1|
|Noisy Student (B1, L2)||81.4||95.6|
|Noisy Student (B2)||81.1||95.5|
|Noisy Student (B2, L2)||82.2||96.0|
|Noisy Student (B3)||82.4||96.2|
|Noisy Student (B3, L2)||83.4||96.6|
|Noisy Student (B4)||84.0||96.8|
|Noisy Student (B4, L2)||84.9||97.2|
|Noisy Student (B5)||84.9||97.2|
|Noisy Student (B5, L2)||85.6||97.6|
|Noisy Student (B6)||85.3||97.5|
|Noisy Student (B6, L2)||86.0||97.7|
|Noisy Student (B7)||85.9||97.6|
|Noisy Student (B7, L2)||86.8||98.0|
a.5 Details for Metrics on Robustness Benchmarks
The top-1 and top-5 accuracy are measured on the 200 classes that ImageNet-A includes. The mapping from the 200 classes to the original ImageNet classes are available online.222https://github.com/hendrycks/natural-adv-examples/blob/master/eval.py
mCE (mean corruption error) is the weighted average of error rate on different corruptions, with AlexNet’s error rate as a baseline. The score is normalized by AlexNet’s error rate so that corruptions with different difficulties lead to scores of a similar scale. Please refer to  for details about mCE and AlexNet’s error rate. The top-1 accuracy is simply the average top-1 accuracy for all corruptions and all severity degrees. The top-1 accuracy of prior methods are computed from their reported corruption error on each corruption.
Flip probability is the probability that the model changes top-1 prediction for different perturbations. mFR (mean flip rate) is the weighted average of flip probability on different perturbations, with AlexNet’s flip probability as a baseline. Please refer to  for details about mFR and AlexNet’s flip probability. The top-1 accuracy reported in this paper is the average accuracy for all images included in ImageNet-P.