# Benchmarking Low-Shot Robustness to Natural Distribution Shifts

$\text{Aaditya Singh}^{*,\dagger}$ $\text{Kartik Sarangmath}^{*}$ Prithvijit
Chattopadhyay Judy Hoffman
$*$ equal contribution $\dagger$ project lead
Georgia Institute of Technology
{singaadi, kartiksarangmath, prithvijit3<EMAIL_ADDRESS>

###### Abstract

Robustness to natural distribution shifts has seen remarkable progress thanks
to recent pre-training strategies combined with better fine-tuning methods.
However, such fine-tuning assumes access to large amounts of labelled data,
and the extent to which the observations hold when the amount of training data
is not as high remains unknown. We address this gap by performing the first
in-depth study of robustness to various natural distribution shifts in
different low-shot regimes: spanning datasets, architectures, pre-trained
initializations, and state-of-the-art robustness interventions. Most
importantly, we find that there is no single model of choice that is often
more robust than others, and existing interventions can fail to improve
robustness on some datasets even if they do so in the full-shot regime. We
hope that our work will motivate the community to focus on this problem of
practical importance. Our code and low-shot subsets are publicly available at
this url.

##  1 Introduction

In the past decade, Computer Vision has made significant progress due to
advanced architectures like Convolutional Neural Networks (CNNs) and Vision
Transformers (ViTs), large datasets, and sophisticated training strategies [1,
2, 3, 4]. However, early learning techniques heavily focused their evaluation
on ImageNet [5] performance, which raised concerns about their ability to
generalize to distribution shifts [6, 7]. To address this, researchers have
proposed a wide-range of evaluation datasets [8, 9, 10, 11, 12] that can be
used to measure out-of-distribution performance of models trained and
validated with in-domain data.

Recent methods [13, 14, 15, 16, 17] use self-supervised or large-scale vision-
language pre-trained models (such as CLIP [4]) and fine-tune them on fully
labelled (in-domain) data to achieve impressive performance on such datasets.
Unfortunately, fine-tuning requires large amounts of data and compute that may
not be accessible to most practitioners. Moreover, it can be difficult and
expensive to collect and consistently annotate such data, especially in
settings like camera traps where images can vary significantly in quality,
lighting, and pose (for instance, iWildCam [18]). These challenges are
compounded by the fact that many images may belong to rare or endangered
species, making annotations even more difficult to obtain. Therefore, it is
important to study which models and fine-tuning methods provide strong out-of-
distribution (OOD) robustness performance when trained with few in-domain (ID)
images. We refer to this setting of fine-tuning a pre-trained model on low-
shot ID images followed by evaluation on OOD images as the “low-shot
robustness” setting (see Fig. 1).

Figure 1: Low-Shot Robustness Setting. (a) We assume access to a pre-trained
model trained on large-scale datasets such as ImageNet [5] and limited in-
domain images (in the order of thousands) for training. We use different kinds
of fine-tuning methods that have been shown to improve robustness when there
is typically order of magnitudes higher training data. (b) We then evaluate
the (low-shot) fine-tuned model on out-of-domain (OOD) data.

From works that demonstrate robustness in the full-shot regime, we seem to
arrive at the following conclusions for robustness to natural distribution
shifts in the full-shot regime: (1) Amongst ImageNet pre-trained
initializations, SSL ViTs are more robust than their supervised and CNN
counterparts, with the more recent ones being better [13, 14]. (2) Even
without additional robustness interventions (i.e. methods to improve
robustness), pre-trained models on large external datasets such as CLIP [4]
provide superior robustness [16]. (3) Such models when combined with state-of-
the-art robustness interventions lead to significant robustness improvements
on several datasets [15, 16, 17]. In this paper, we question to what extent
these conclusions hold true when the amount of training data is not as high.

Overall, we perform the first in-depth study of robustness to various natural
distribution shifts in different low-shot regimes: spanning datasets,
architectures, pre-trained initializations, and state-of-the-art robustness
interventions. Through our experiments, we aim to answer the following key
questions:

  * Q1. For ImageNet pre-trained models, what kind of pre-training strategies and architectures are most effective for robustness in low-shot regimes?
A: Self-supervised ViTs generally perform better on both ID and OOD shifts
than CNNs and the supervised counterparts (where applicable), but no single
initialization or model size works better across datasets.

    * •

For ImageNet and iWildCam [18] datasets, MSN ViT [14] performs better than
other models on OOD shifts, however a smaller model size (ViTS-16) works
better for iWildCam but not for ImageNet.

    * •

For Camleyon [19] dataset which is non object-centric, DINO ViTS-16 [20]
outperforms other models including DINO ViTB-16 and MSN ViTS-16 on both ID and
OOD shifts.

  * Q2. Do models pre-trained on large external datasets, such as CLIP, provide superior robustness compared to ImageNet pre-trained ones on different datasets?
A: While we generally conform with the findings of recent works [15, 16, 17]
and find that models such as CLIP [4] provide superior robustness on ImageNet
and in full-shot regimes, we find that ImageNet pre-trained models can be
better on other datasets such as iWildCam and Camelyon in the low-shot
regimes.

    * •

Comparing ViTB-16 architecture on these datasets, DINO initialization
outperforms CLIP (zero-shot or otherwise) and ImageNet-21k [21] supervised ViT
on both ID and OOD shifts.

    * •

ImageNet supervised ViT [22] significantly outperforms ImageNet-21k supervised
ViT on OOD shifts.

  * Q3. When using robustness interventions, does better robustness in the full-shot regime also imply better robustness in the low-shot regimes?
A: Not always. We find that depending on the initialization, existing
interventions can fail to improve robustness in the full-shot regime or in
some of the low-shot regimes for datasets other than ImageNet.

    * •

On iWildCam, interventions often fail to improve robustness with MSN ViTB-16
in the full-shot regime. On the other hand, only WiSE-FT [16] significantly
improves robustness with CLIP ViTB-16 in both the full and low-shot regimes.

    * •

On Camelyon, while interventions often improve robustness in the full-shot
regime for both MSN and CLIP ViTB-16, they fail to do so either in extreme
($\sim 3000$ images) or in moderate ($\sim 15000$ images) low-shot regimes,
except WiSE-FT with CLIP.

As highlighted by our findings, conventional wisdom for robustness to natural
distribution shifts in the full-shot regime might not apply in the low-shot
regimes, and should be seen as an important challenge for future work.

##  2 Related Work

Robustness studies. Real-world models may encounter and struggle to generalize
on data distributions different than the ones used for training [23, 24].
Previous works have studied such generalization capability of models under
synthetic [25, 26, 27, 28, 29, 30] and natural distribution shifts [7, 8, 9,
10, 11, 12]. Researchers have also looked at the effect of architecture, i.e.
CNNs and ViTs on robustness to different kinds of shifts [31, 32, 33, 34] and
distortion robustness of several models in comparison to humans [35]. In
particular, [36] perform a large-scale study of several supervised models and
find that interventions used for synthetic shifts offer little to no
robustness gains for natural distribution shifts. On the other hand, accuracy
under natural distribution shifts can often be reliably estimated by the in-
distribution accuracy [37, 38, 36, 39] except for some shifts [40, 41].
Crucially, these works perform evaluations after training on fully labelled
datasets with hundreds of thousands or millions of images which can be out of
reach for most practitioners. We therefore perform experiments in the low-shot
regime and observe its impact on robustness to various natural distribution
shifts.

Domain generalization. In domain generalization, the goal is to generalize to
an inaccessible target domain while assuming access to one or more fully
labelled source domains [42, 43, 44, 45, 46, 47, 48]. While recent methods
often use vision-language models such as CLIP [4] for impressive robustness
gains through strategic fine-tuning [15] or weight-space ensembles [16, 17],
they also rely on abundant labelled data for training which can be prohibitive
for practitioners. Thus, we investigate the effectiveness of these methods in
low-shot regimes on diverse datasets.

Self-supervised learning. Researchers have shown self-supervised learning
(SSL) to be better or on-par with supervised learning for pre-training deep
networks for various downstream tasks [49, 50, 20, 51, 13, 14] and we refer
the reader to [52, 53] for thorough literature reviews. Recent methods that
leverage ViTs [13, 14] demonstrate superior robustness to some natural
distribution shifts [9, 10, 11] compared to previous state-of-the-art methods
without additional interventions. However, such evaluations are performed only
after fine-tuning on full ImageNet and whether the trend holds for other
datasets and in different low-shot regimes remains an open question. We aim to
address this gap in our work by evaluating some of the most recent SSL ViTs on
a variety of datasets and distribution shifts, also comparing with CNNs and
the supervised counterparts.

Few-shot learning. Few-shot learning aims to generalize to novel classes from
a few samples belonging to these classes [54, 55, 56]. While meta-learning
based approaches used to be popular on standard benchmarks [57, 58, 59, 60], a
growing wave of research showed that simpler transfer learning-based
approaches can also achieve competitive performance [61, 62]. Recently, [63]
conform with this finding on the more challenging cross-domain few-shot
learning (CD-FSL) scenario where the source and novel classes belong to
different domains. Since then, works often perform SSL pre-training on the
source data followed by low-shot fine-tuning on the few examples of novel
classes [51, 64, 65]. However, unlike the (cross-domain) few-shot scenario, we
use the target or out-of-distribution (OOD) data only for evaluation purposes
similar to most other robustness studies. Nonetheless, we use the classifiers
presented in [63] and present their detailed comparison on different datasets
and associated design choices in section 7.2 of appendix.

##  3 Preliminaries: Robustness Metrics

Although using out-of-distribution (OOD) shifts to measure absolute
performance can suggest robustness, it overlooks the in-domain (ID)
performance of a model. As pointed in [36], two models with similar OOD
performance can have vastly different ID performances. A better definition of
robustness should consider the OOD performance beyond what is expected from
achieving some level of ID performance. Therefore, to measure robustness, in
addition to absolute performance comparison we also adopt the effective and
relative robustness framework used in previous works [7, 36, 16]. We now
describe these metrics in detail.

Key to measuring effective robustness is establishing an expected baseline OOD
accuracy given some ID accuracy $x$. This is established by computing a log-
linear fit $\beta(x)$ over ID and OOD accuracies, i.e. $acc^{s}_{id}$ and
$acc^{s}_{ood}$ respectively, for a set of standard models
$f^{s}_{1},f^{s}_{2},\dots f^{s}_{n}$ as:

$\beta(x)=\sigma(w\text{ logit}(x)+b)$ (1)

where $\text{logit}(x)=\ln{\frac{1}{1-x}}$ and $\sigma$ is the inverse of the
logit function. In practice, $\beta(x)$ is obtained by mapping each point
$(x,y)\rightarrow(\text{logit}(x),\text{logit}(y))$ and solving linear
regression. This can be visualized by plotting ($acc^{s}_{id}$,
$acc^{s}_{ood}$) on a scatter plot with the $x$ and $y$ axes denoting ID and
OOD accuracies respectively.

Once obtained, effective robustness of an “intervention”111For models pre-
trained on large external datasets such as CLIP [4], it’s unclear what
datasets are considered in or out-of-distribution, so we exclude it from the
standard set of models and treat it as an intervention. $r$ applied on the
model $f^{s}$, i.e. $f^{r}=(acc^{r}_{id},acc^{r}_{ood})$ can be expressed as:

$\rho(f^{r})=acc^{r}_{ood}-\beta(acc^{r}_{id})$ (2)

which outlines if the intervention leads to OOD accuracy beyond what is
expected from having a higher ID accuracy.

While effective robustness is important, it is not enough to provide a
comprehensive evaluation of models, especially in the low-shot regimes. An
“intervention” on a model may result in high positive $\rho(f^{r})$,
indicating effective robustness, but it could also decrease both ID and OOD
accuracies which is not desirable. Thus, in addition to effective robustness,
we measure relative robustness by assessing the impact of an intervention on
OOD accuracy as:

$\tau(f^{r})=acc^{r}_{ood}-acc^{s}_{ood}$ (3)

Following [36], an intervention $r$ is said to improve the robustness of a
model $f^{s}$ only when it exhibits both effective and relative robustness,
that is, $\rho(f^{r})>0$ and $\tau(f^{r})>0$. However, our experiments
indicate that interventions frequently lack simultaneous effective and
relative robustness across various low-shot regimes. For simplicity, we refer
to $\rho(f^{r})$ as $\rho$ and $\tau(f^{r})$ as $\tau$.

##  4 Experimental Setting

Following prior work, we study image classification under natural distribution
shifts [4, 16]. We describe our experimental setting with the associated
design choices and justifications in this section.

###  4.1 Datasets and Low-Shot Regimes

Dataset | Low-Shot Regimes (Imgs / Class)
---|---
Extreme | Moderate | High
1 ImageNet [5] | $1$ | $5$ | $\sim 13$
2 iWildCam [18] |  $1$-$480$ |  $1$-$4802$ |  $1$-$9604$
3 Camelyon [19] | $1500$ | $7500$ | $15000$

Table 1: Different Low-Shot Regimes. We consider low-shot regimes with similar
number of images for different datasets and describe them in more detail in
section 4.1.

Prior studies [36, 39] have observed a linear trend for certain supervised
models on ImageNet [5] and iWildCam [18] datasets after applying the logit
function (see Eq. 1), while contrasting evidence has been reported for other
datasets, such as Camelyon [19], in [41]. To obtain a comprehensive view of
robustness in low-shot regimes, where a strong correlation between in-domain
(ID) and out-of-distribution (OOD) performances may or may not exist, we
conduct experiments on all three datasets.

ImageNet & Distribution Shifts. ImageNet (IN1k) [5] is an extensive dataset
for image recognition that consists of objects and scenes belonging to one of
the 1000 classes. For training, we use the subsets with 1, 5, and $\sim$13
images per class (see table 1 row 1) used by [14] for comparison of self-
supervised methods based on in-domain (ID) accuracy. We use the IN1k
validation split for model validation based on top-1 accuracy.222While the
optimal model checkpoint for ID performance might not be so for OOD
performance, it is a widely adopted practice [36, 15] that allows for a fair
comparison across different methods. For testing, we report the average top-1
accuracy on the following $5$ natural distribution shifts:

ImageNet-R (IN-R) [11] has 200 classes in common with IN1k and rendition
images such as sculptures and paintings

ImageNet-S (IN-S) [9] consists of around 50,000 images of sketches, similar to
the size of IN1k’s validation set

ImageNet-A (IN-A) [10] has 200 classes in common with IN1k and images that are
classified incorrectly by a supervised ResNet-50 (RN50) [1] trained on IN1k

ImageNet-v2 (IN-v2) [7] consists of similar images as in IN1k’s test set but
from a different distribution

ObjectNet (ON) [8] has 113 classes in common with IN1k and images that vary in
rotation, background, and viewpoint

Figure 2: Datasets & Distribution Shifts. We show some sample images from
ImageNet [5], iWildCam [18], and Camelyon [19] datasets and associated
distribution shifts [9, 11].

iWildCam. The iWildCam [18] dataset comprises images of $182$ animal species
captured by various cameras traps, which are treated as different
distributions. We use the WILDS benchmark [12] and manually curate low-shot
subsets from train shift for training which has $129809$ images, val-id shift
for validation which has $7314$ images, and val-ood shift for testing which
has $14961$ images. Since these sets have an imbalanced class distribution, We
sample images from the different classes in 1%, 10%, and 20% ratios from the
train shift, ensuring that each class has at least one image. This results in
low-shot subsets with $1370$, $12973$, and $25931$ images, respectively (see
table 1 row 2). Additionally, we report average per-class accuracy for both
validation and testing.

Camelyon. The Camelyon [18] dataset consists of $96\times 96$
histopathological images that may or may not contain tumor tissue, resulting
in $2$ classes. These scans are sourced from different hospitals that are
considered different distributions. We again use the WILDS benchmark [12] and
manually curate low-shot subsets from train shift for training which has
$302436$ images, val-id shift for validation which has $33560$ images, and
val-ood shift for evaluation which has $34904$ images.333We emphasize that the
val-ood shifts are used only for evaluation. While test-ood shifts are also
available in WILDS benchmark [12], they have similar creation processes but
larger number of images than the val-ood shifts, so we opt for the latter due
to limited compute. The shifts are well-balanced, so we create subsets
containing $1500$, $7500$, and $15000$ images per class (see table 1 row 3).
We report the average per-class accuracy for validation and testing and find
that it is within 1 percentage point of top-1 accuracy.

###  4.2 Standard Models

Recall that to establish a baseline out-of-distribution accuracy $\beta(x)$
for a given in-domain accuracy $x$, fitting Eq. 1 for a set of “standard”
models is required. We consider a standard set of ImageNet (IN1k) pre-trained
models for this purpose, which are not subjected to additional robustness
interventions or pre-training data. The selection of these models is based on
their low-shot ID performance comparison on IN1k [66] or average performance
on various downstream tasks [51]. We show the architectures used in our
experiments ordered by the number of parameters (i.e. size) below. More
detailed comparison is also shown in table 11 in appendix.

$\text{ViTS-16}\approx\text{RN50}<\text{ViTB-16}\approx\text{RN50w2}<\text{ViTL-16}$

Self-supervised models. We include the following self-supervised (SSL) models
for our experiments.

SwAV [67]: SwAV is a SSL method for pre-training CNNs by predicting cluster
assignments for different augmented views of an image and enforcing
consistency between them. We use the RN50 and RN50w2 checkpoints for all
datasets.

DINO [20]: DINO self-trains a student network to match the feature embeddings
of augmented local and global views of an image to that of a teacher network
which sees only the global view. We use the RN50, ViTS-16, and ViTB-16
checkpoints for all datasets.

MSN [14]: MSN matches the predicted cluster assignments for masked and
unmasked augmented views of an image and performs well on low-shot ID
evaluation on ImageNet. We use the ViTS-16 and ViTB-16 checkpoints for all
datasets and ViTL-16 checkpoint for ImageNet.

Supervised models. For datasets other than ImageNet, we additionally include
DEIT [22] (ViTS-16, ViTB-16) and supervised ResNet-50 from PyTorch [68]. Note
that for ImageNet, these models violate the “low-shot” condition as they have
already been trained with the full labelled dataset.

Fitting Standard Models. To obtain the parameters ($w$ and $b$) of the log-
linear curve for $\beta(x)$ in Eq. 1 for a dataset, we first train individual
models from the standard set on different low-shot subsets and full-shot
subset (details in Sec. 4.3). Fine-tuning and subset details are provided in
appendix, Sec. 7. We then evaluate the trained models on both ID validation
and OOD test shifts, out of which only the former is used for hyperparameter
tuning. In case of multiple OOD test shifts, we calculate the average OOD
performance following previous work [16]. We assess the quality of the curve
fit via mean absolute error (MAE) and coefficient of determination ($R^{2}$)
of the curve on these data points, as shown in table 4. Finally, the curve
$\beta(x)$ is used to calculate effective robustness of an intervention using
Eq. 2.

###  4.3 Low-Shot Training

For low-shot finetuning, we freeze the pre-trained models and train a
classifier on top with the available training data. We compare the following
classifiers based on prior work in cross-domain few-shot learning [63] –
Logistic Regression [62], Mean-Centroid Classifier [58], and Baseline++ [61] –
and select the best-performing one for each dataset. While Logistic Regression
performs better or on-par on both ID and OOD shifts for ImageNet and iWildCam,
Baseline++ performs better on Camelyon. We provide this comparison and more
details in appendix, Sec. 7.2.

###  4.4 Robustness Interventions

We consider some of the most recent methods for improving robustness to
natural distribution shifts and models pre-trained on large external datasets
as robustness interventions (see Sec. 2). We briefly summarize them below:

  * LP-FT [15]: LP-FT follows a two-stage strategy of first fine-tuning only the randomly initialized linear head followed by fine-tuning the entire model end-to-end on fully labelled datasets.

  * CLIP [4]: CLIP is a vision-language model that is pre-trained on a large number of ($\sim$ 400M) image-text pairs. It shows strong zero-shot performance on several datasets and is often used as the de-facto initialization by several works [15, 17, 16].

  * WiSE-FT [16]: WiSE-FT applies a weight-space ensemble between a zero-shot model such as CLIP and this model fine-tuned on fully labelled datasets. For IN1k pre-trained models, we ensemble between the weights of linear-probed (LP) and LP-FT checkpoints due to the absence of a zero-shot head. We use $\alpha=0.5$ unless mentioned otherwise.

  * Model Soups [17]: Model Soups uses a weight-space ensemble of several models that are trained with a different epochs, learning rates, weight decay, label smoothing [69], mixup [70], and RandAugment [71]. Due to limited compute and the scale of experiments, we use a greedy soup with 9 models and again use linear-probing for the head initialization. We follow the paper for hyperparameter values.

  * RobustViT [72]: RobustViT first uses an unsupervised object localization method such as TokenCut [73] to dump offline segmentation maps. It then optimizes a supervised ViT’s saliency maps [74] to resemble these offline segmentation maps while maintaining its classification accuracy.

For a fair and uniform comparison across datasets, we apply the relevant
interventions on MSN ViTB-16 and use it as the reference model for computing
effective and relative robustness (see Sec. 3). Additionally, we include CLIP
with LP-FT, WiSE-FT, and Model Soups as interventions, based on their reported
performances [15, 16, 17] and strong performance on ID and OOD shifts in our
experiments. We use ViTB-16 architecture for CLIP which performed
substantially better than the RN50 variant, as shown in table 9 in appendix.
Despite being amenable to low-shot finetuning, we find that it is non-trivial
to implement RobustViT for self-supervised ViTs that perform better on OOD
shifts and downstream tasks [13, 14]. Also due to its requirement of offline
segmentation maps, it remains challenging to implement for non-object centric
datasets such as Camelyon. We provide details on the hyperparameter choices
associated with each intervention in section 9 of appendix.

##  5 Results

We now present findings for $3$ key questions from Sec. 1 – (1) among ImageNet
pre-trained models, which ones are more robust in low-shot regimes (see table
1) (2) how do they compare with models pre-trained on larger datasets and (3)
do robustness interventions help in the low-shot regimes.

###  5.1 Comparing ImageNet Pre-trained Models

We compare ImageNet pre-trained models with similar number of parameters
(ViTS-16 and RN50) on the basis of absolute ID and OOD performances in Fig. 3.
For a uniform comparison, we randomly initialize the classifier head (see Sec.
4.3) and use the same hyperparameters for all models. It can be seen that
self-supervised (SSL) ViTs often perform better than SSL CNNs on ImageNet and
supervised ViTs and CNNs on iWildCam and Camelyon datasets.

However, the best initialization and model size varies for each dataset as
shown in table 2. For a concise comparison, we show the average ID and OOD
performances across different low-shot regimes. MSN ViTB-16 outperforms DINO
ViTB-16 and MSN ViTS-16 on ImageNet, but not on iWildCam where MSN ViTS-16
performs better on OOD shift. Similarly, DINO ViTS-16 performs better than
other models on both ID and OOD shifts on Camelyon.

Thus, while SSL ViTs perform better on both ID and OOD shifts than SSL CNNs
and the supervised counterparts (where applicable) in the low-shot regimes, no
single initialization or model size performs the best across datasets.

Figure 3: Comparison of ImageNet pre-trained architectures and
initializations. With similar number of parameters, self-supervised (SSL) ViTs
generally perform better on both ID and OOD shifts compared to SSL CNNs and
the supervised counterparts where applicable.

| ImageNet | iWildCam | Camelyon
---|---|---|---
| ID | OOD | ID | OOD | ID | OOD
1 MSN ViTS-16 [14] | 58.99 | 21.51 | 26.41 | 19.99 | 83.62 | 75.67
2 DINO ViTS-16 [20] | 53.78 | 19.09 | 24.78 | 19.75 | 88.08 | 85.09
3 MSN ViTB-16 [14] | 61.40 | 22.81 | 24.78 | 19.65 | 86.40 | 78.84
4 DINO ViTB-16 [20] | 56.72 | 21.98 | 27.40 | 19.82 | 86.93 | 84.33

Table 2: Comparison of ImageNet pre-trained self-supervised ViTs. On average
across low-shot regimes, no single self-supervised initialization or model
size outperforms others on ID and OOD shifts across datasets.

###  5.2 Pre-training Data Scale and Strategy

| ImageNet | iWildCam | Camelyon
---|---|---|---
| ID | OOD | ID | OOD | ID | OOD
1 CLIP zero shot [4, 16] | 67.93 | 57.37 | 9.67 | 16.82 | 50.48 | 51.55
2 CLIP [4] | 50.8 | 27.50 | 23.75 | 19.10 | 84.9 | 77.3
3 Supervised (IN21k) [3] | N/A | N/A | 16.84 | 16.90 | 85.18 | 81.07
4 Supervised (IN1k) [22] | N/A | N/A | 22.27 | 18.57 | 83.35 | 83.24
5 MSN (IN1k) [14] | 61.40 | 22.81 | 24.78 | 19.65 | 86.40 | 78.84
6 DINO (IN1k) [20] | 56.72 | 21.98 | 27.40 | 19.82 | 86.93 | 84.33

Table 3: Comparison between ViTs pre-trained on different datasets. On average
across low-shot regimes, ImageNet (IN) pre-trained SSL ViT’s such as DINO are
worse than CLIP on ImageNet. However, it performs much better than CLIP and
IN-21k supervised ViT on iWildCam and Camelyon datasets.

We question whether models pre-trained on large external datasets provide
superior robustness than ImageNet (IN1k) pre-trained ones in the low-shot
regimes without additional interventions. We compare CLIP ViT and a supervised
ViT pre-trained on ImageNet-21k (IN21k) [3, 21] with IN1k pre-trained ViT’s.
We use the ViTB-16 architecture with the same classifiers described in Sec.
4.3.

We again compare the absolute performance on ID and OOD shifts on average
across low-shot regimes. As with the IN1k supervised models, IN21k supervised
ViT violates the “low-shot” premise so we don’t use it on ImageNet. For CLIP
zero-shot results, we match the implementation of [16] and provide additional
details in appendix, Sec. 7.2.

As shown in table 3, CLIP’s zero-shot performance on ID and OOD shifts on
ImageNet is significantly better than both CLIP and IN1k pre-trained models.
However, CLIP (zero-shot or otherwise) performs worse than IN1k pre-trained
models on iWildCam and Camelyon, on which DINO performs better than other
models. IN21k supervised ViT often performs significantly worse than IN1k
supervised ViT on these datasets, especially on OOD shifts.

Thus, IN1k pre-trained models can perform better on both ID and OOD shifts
than the models pre-trained on large external datasets in low-shot regimes, on
datasets such as iWildCam and Camelyon.

###  5.3 Effect of Robustness Interventions

We question to what extent do existing robustness interventions improve
robustness in the low-shot regimes and how does the trend compare with the
full-shot regime, and present the dataset-wise observations below.

Figure 4: Effect of robustness interventions on ImageNet. Plots (a), (b), and
(c) show performance of interventions in low-shot regimes (see table 1). Plot
(d) shows performance of interventions in the full-shot regime. Interventions
located above the line ($\rho>0$) and in the blue region ($\tau>0$) are said
to improve robustness (see Sec. 3). Interventions largely improve robustness
in the low-shot regimes with MSN ViTB-16, and in all data regimes when coupled
with CLIP ViTB-16.  Figure 5: Effect of robustness interventions on iWildCam.
Interventions often fail to improve robustness in both the full and low-shot
regimes with MSN ViTB-16. Only WiSE-FT with CLIP ViTB-16 improves robustness
in all data regimes.  Figure 6: Effect of robustness interventions on
Camelyon. Interventions often improve robustness in the full-shot regime with
both MSN and CLIP ViTB-16 but fail to do so in extreme or moderate low-shot
regimes, except WiSE-FT with CLIP ViTB-16.

ImageNet. We show the results of this experiment in Fig. 4. With MSN,
interventions are largely effectively and relatively robust in the different
low-shot regimes, except LP-FT in the high low-shot regime. While the
interventions are also effectively robust in the full-shot regime, they are
often not relatively robust, except RobustViT which improves robustness in all
regimes.

When coupled with CLIP, Model Soups and WiSE-FT also become effectively and
relatively robust in all data regimes with the latter providing largest
robustness improvements. Zero-shot CLIP also improves robustness significantly
in low-shot regimes (see table 5), suggesting that not using the limited
training data is a better approach. However, we find that it is not the case
on other datasets.

iWildCam. We show the results of this experiment in Fig. 5. With MSN,
interventions are often relatively but not effectively robust in the low-shot
regimes and neither effectively nor relatively robust in the full-shot regime.
Unlike ImageNet, CLIP’s zero-shot performance is quite worse (see table 5) and
WiSE-FT with CLIP is the only intervention which improves robustness in all
data regimes.

Dataset | $\text{MAE}\downarrow$ | $R^{2}\uparrow$
---|---|---
1 ImageNet [5] | 1.75 | 0.94
2 iWildCam [18] | 1.50 | 0.96
3 Camelyon [19] | 3.44 | 0.50
Table 4: Quality of curve fit. Curve $\beta(x)$ fit on the accuracies of
standard models (see Sec. 4.2) leads to a relatively higher MAE and lower
$R^{2}$ on Camelyon, indicating the poor quality of fit.

Camelyon. We show the results of this experiment in Fig. 6. Note that for
Camelyon, the quality of curve $\beta(x)$ fit with the ID and OOD accuracies
of standard models is relatively low compared to other datasets as shown in
table 4, in which case relative robustness should be prioritized since it
doesn’t rely on the quality of the fit. While interventions improve relative
robustness in the full-shot regime with MSN, they fail to do so in the
moderate low-shot regime. Similarly, interventions improve robustness in the
full-shot regime with CLIP, but LP-FT fails to be relatively robust in the
moderate low-shot regime whereas Model Soups fails to be relatively robust in
both the extreme and moderate low-shot regimes. Only WiSE-FT ($\alpha=1$) with
CLIP improves robustness in all data regimes. CLIP’s zero-shot performance is
near random as shown in table 3.

We show the effective and relative robustness of the interventions in the
full-shot regimes in table 5. To complement our findings, we also highlight
the interventions which significantly444We use the standard deviation of
residuals obtained after fitting $\beta(x)$ to determine significance, and
provide more details in appendix, Sec. 10. improve robustness across both the
full-shot regime and majority of low-shot regimes for each dataset. We see
that (1) most interventions significantly improve robustness on ImageNet but
not on other datasets and (2) no intervention significantly improves
robustness across datasets and data regimes, except WiSE-FT with CLIP.

| ImageNet | iWildCam | Camelyon
---|---|---|---
| $\rho\uparrow$ | $\tau\uparrow$ | $\rho\uparrow$ | $\tau\uparrow$ | $\rho\uparrow$ | $\tau\uparrow$
Full-Shot Regime |  |  |  |  |  |
1 LP-FT [15] | 5.16 | -0.61 | -1.41 | -0.17 | -0.45 | 7.48
2 \+ CLIP | 19.60∗ | $\text{13.77}^{*}$ | -3.60 | -6.09 | 0.37 | 11.28
3 WiSE-FT [16] | 6.66 | -0.86 | -3.84 | -5.87 | 6.22 | 12.66
4 \+ CLIP | $\text{22.24}^{*}$ | $\text{16.41}^{*}$ | 3.98 | 4.78 | 2.85 | 14.18
5 Model Soups [16] | 0.53 | -10.58 | -0.93 | -0.14 | -0.35 | 11.68
6 \+ CLIP | $\text{11.00}^{\dagger}$ | $\text{4.29}^{\dagger}$ | 3.20 | -4.84 | 5.93 | 9.50
7 RobustViT [72] | 6.73 | 1.13 | N/A | N/A | N/A | N/A
8 CLIP zero-shot [4, 16] | 30.28 | 10.79 | 8.46 | -23.167 | -14.63 | -28.54

Table 5: Robustness intervention comparison. The table shows effective
($\rho$) and relative ($\tau$) robustness of different interventions in the
full-shot regime. $*$ and $\dagger$ denote numbers obtained from papers for
ViTB-16 and ViTB-32 architecture respectively. Interventions that do not
improve robustness in the full-shot regime are shown in gray, while
interventions that do so are shown in black. Interventions that significantly
improve robustness in both the full-shot regime and majority of low-shot
regimes are highlighted in blue for each dataset. Robustness results for the
low-shot regimes (as shown in Fig. 4, 5, and 6) are also provided in the
appendix. Most interventions significantly improve robustness on ImageNet but
not on other datasets, except WiSE-FT with CLIP.

Limitations. We note that there are limitations to our study. First, we were
unable to observe the effects of in-domain SSL pre-training on datasets other
than ImageNet. As noted by [51], the complex and resource-intensive training
procedures render it beyond the scope of our study. Recent work [66] has also
shown that the current objectives of self-supervised methods such as MSN and
DINO might not be suitable for class-imbalanced datasets (e.g. iWildCam).
Second, while we incorporate different kinds of augmentations and loss
functions as a part of interventions such as Model Soups, singly analyzing
their effect on robustness in low-shot regimes remains an avenue for future
work.

##  6 Conclusion

We conclude our study of low-shot robustness to several natural distribution
shifts, which addresses the gap in the literature and marks the first in-depth
study of its kind. From our evaluations, we observe that: (1) Self-supervised
ViTs are often more robust in low-shot regimes across different datasets
amongst ImageNet pre-trained initializations, but the best initialization or
model size is dataset dependent. (2) Without additional interventions, models
pre-trained on large external datasets such as CLIP can be much more robust on
ImageNet but not on datasets such as iWildCam and Camelyon. (3) Depending on
the initialization, robustness interventions fail to improve robustness in the
full-shot regime or in different low-shot regimes on such datasets. We hope
that our study will motivate researchers to also focus on this problem of
practical importance.

## Acknowledgements

This work was supported in part by NASA ULI and ARL. We would also like to
thank our internal reviewers Anisha Pal, Bharat Goyal, and Pratik Ramesh for
their constructive suggestions on an early draft of this paper.

## References

  * [1] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770–778, 2016.
  * [2] A. Kolesnikov, L. Beyer, X. Zhai, J. Puigcerver, J. Yung, S. Gelly, and N. Houlsby, “Big transfer (bit): General visual representation learning,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part V 16, pp. 491–507, Springer, 2020.
  * [3] A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, et al., “An image is worth 16x16 words: Transformers for image recognition at scale,” arXiv preprint arXiv:2010.11929, 2020.
  * [4] A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark, et al., “Learning transferable visual models from natural language supervision,” in International conference on machine learning, pp. 8748–8763, PMLR, 2021.
  * [5] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE conference on computer vision and pattern recognition, pp. 248–255, Ieee, 2009.
  * [6] R. Geirhos, J.-H. Jacobsen, C. Michaelis, R. Zemel, W. Brendel, M. Bethge, and F. A. Wichmann, “Shortcut learning in deep neural networks,” Nature Machine Intelligence, vol. 2, no. 11, pp. 665–673, 2020.
  * [7] B. Recht, R. Roelofs, L. Schmidt, and V. Shankar, “Do imagenet classifiers generalize to imagenet?,” in International conference on machine learning, pp. 5389–5400, PMLR, 2019.
  * [8] A. Barbu, D. Mayo, J. Alverio, W. Luo, C. Wang, D. Gutfreund, J. Tenenbaum, and B. Katz, “Objectnet: A large-scale bias-controlled dataset for pushing the limits of object recognition models,” Advances in neural information processing systems, vol. 32, 2019.
  * [9] H. Wang, S. Ge, Z. Lipton, and E. P. Xing, “Learning robust global representations by penalizing local predictive power,” Advances in Neural Information Processing Systems, vol. 32, 2019.
  * [10] D. Hendrycks, K. Zhao, S. Basart, J. Steinhardt, and D. Song, “Natural adversarial examples,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 15262–15271, 2021.
  * [11] D. Hendrycks, S. Basart, N. Mu, S. Kadavath, F. Wang, E. Dorundo, R. Desai, T. Zhu, S. Parajuli, M. Guo, et al., “The many faces of robustness: A critical analysis of out-of-distribution generalization,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 8340–8349, 2021.
  * [12] P. W. Koh, S. Sagawa, H. Marklund, S. M. Xie, M. Zhang, A. Balsubramani, W. Hu, M. Yasunaga, R. L. Phillips, I. Gao, et al., “Wilds: A benchmark of in-the-wild distribution shifts,” in International Conference on Machine Learning, pp. 5637–5664, PMLR, 2021.
  * [13] K. He, X. Chen, S. Xie, Y. Li, P. Dollár, and R. Girshick, “Masked autoencoders are scalable vision learners,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 16000–16009, 2022.
  * [14] M. Assran, M. Caron, I. Misra, P. Bojanowski, F. Bordes, P. Vincent, A. Joulin, M. Rabbat, and N. Ballas, “Masked siamese networks for label-efficient learning,” in Computer Vision–ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23–27, 2022, Proceedings, Part XXXI, pp. 456–473, Springer, 2022.
  * [15] A. Kumar, A. Raghunathan, R. Jones, T. Ma, and P. Liang, “Fine-tuning can distort pretrained features and underperform out-of-distribution,” arXiv preprint arXiv:2202.10054, 2022.
  * [16] M. Wortsman, G. Ilharco, J. W. Kim, M. Li, S. Kornblith, R. Roelofs, R. G. Lopes, H. Hajishirzi, A. Farhadi, H. Namkoong, et al., “Robust fine-tuning of zero-shot models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7959–7971, 2022.
  * [17] M. Wortsman, G. Ilharco, S. Y. Gadre, R. Roelofs, R. Gontijo-Lopes, A. S. Morcos, H. Namkoong, A. Farhadi, Y. Carmon, S. Kornblith, et al., “Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time,” in International Conference on Machine Learning, pp. 23965–23998, PMLR, 2022.
  * [18] S. Beery, E. Cole, and A. Gjoka, “The iwildcam 2020 competition dataset,” arXiv preprint arXiv:2004.10340, 2020.
  * [19] P. Bandi, O. Geessink, Q. Manson, M. Van Dijk, M. Balkenhol, M. Hermsen, B. E. Bejnordi, B. Lee, K. Paeng, A. Zhong, et al., “From detection of individual metastases to classification of lymph node status at the patient level: the camelyon17 challenge,” IEEE transactions on medical imaging, vol. 38, no. 2, pp. 550–560, 2018.
  * [20] M. Caron, H. Touvron, I. Misra, H. Jégou, J. Mairal, P. Bojanowski, and A. Joulin, “Emerging properties in self-supervised vision transformers,” in Proceedings of the IEEE/CVF international conference on computer vision, pp. 9650–9660, 2021.
  * [21] T. Ridnik, E. Ben-Baruch, A. Noy, and L. Zelnik-Manor, “Imagenet-21k pretraining for the masses.[arxiv],” DOI: https://doi. org/10.48550/arXiv, vol. 2104, 2021.
  * [22] H. Touvron, M. Cord, M. Douze, F. Massa, A. Sablayrolles, and H. Jégou, “Training data-efficient image transformers & distillation through attention,” in International conference on machine learning, pp. 10347–10357, PMLR, 2021.
  * [23] J. Quionero-Candela, M. Sugiyama, A. Schwaighofer, and N. D. Lawrence, Dataset Shift in Machine Learning.  The MIT Press, 2009.
  * [24] A. Torralba and A. A. Efros, “Unbiased look at dataset bias,” in CVPR 2011, pp. 1521–1528, IEEE, 2011.
  * [25] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017.
  * [26] F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” arXiv preprint arXiv:1705.07204, 2017.
  * [27] R. Geirhos, C. R. Temme, J. Rauber, H. H. Schütt, M. Bethge, and F. A. Wichmann, “Generalisation in humans and deep neural networks,” Advances in neural information processing systems, vol. 31, 2018.
  * [28] K. Eykholt, I. Evtimov, E. Fernandes, B. Li, A. Rahmati, C. Xiao, A. Prakash, T. Kohno, and D. Song, “Robust physical-world attacks on deep learning visual classification,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1625–1634, 2018.
  * [29] M. A. Alcorn, Q. Li, Z. Gong, C. Wang, L. Mai, W.-S. Ku, and A. Nguyen, “Strike (with) a pose: Neural networks are easily fooled by strange poses of familiar objects,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4845–4854, 2019.
  * [30] D. Hendrycks and T. Dietterich, “Benchmarking neural network robustness to common corruptions and perturbations,” arXiv preprint arXiv:1903.12261, 2019.
  * [31] M. M. Naseer, K. Ranasinghe, S. H. Khan, M. Hayat, F. Shahbaz Khan, and M.-H. Yang, “Intriguing properties of vision transformers,” Advances in Neural Information Processing Systems, vol. 34, pp. 23296–23308, 2021.
  * [32] Y. Bai, J. Mei, A. L. Yuille, and C. Xie, “Are transformers more robust than cnns?,” Advances in Neural Information Processing Systems, vol. 34, pp. 26831–26843, 2021.
  * [33] D. Zhou, Z. Yu, E. Xie, C. Xiao, A. Anandkumar, J. Feng, and J. M. Alvarez, “Understanding the robustness in vision transformers,” in International Conference on Machine Learning, pp. 27378–27394, PMLR, 2022.
  * [34] Z. Wang, Y. Bai, Y. Zhou, and C. Xie, “Can cnns be more robust than transformers?,” arXiv preprint arXiv:2206.03452, 2022.
  * [35] R. Geirhos, K. Narayanappa, B. Mitzkus, T. Thieringer, M. Bethge, F. A. Wichmann, and W. Brendel, “Partial success in closing the gap between human and machine vision,” Advances in Neural Information Processing Systems, vol. 34, pp. 23885–23899, 2021.
  * [36] R. Taori, A. Dave, V. Shankar, N. Carlini, B. Recht, and L. Schmidt, “Measuring robustness to natural distribution shifts in image classification,” Advances in Neural Information Processing Systems, vol. 33, pp. 18583–18599, 2020.
  * [37] C. Yadav and L. Bottou, “Cold case: The lost mnist digits,” Advances in neural information processing systems, vol. 32, 2019.
  * [38] J. Miller, K. Krauth, B. Recht, and L. Schmidt, “The effect of natural distribution shift on question answering models,” in International Conference on Machine Learning, pp. 6905–6916, PMLR, 2020.
  * [39] J. P. Miller, R. Taori, A. Raghunathan, S. Sagawa, P. W. Koh, V. Shankar, P. Liang, Y. Carmon, and L. Schmidt, “Accuracy on the line: on the strong correlation between out-of-distribution and in-distribution generalization,” in International Conference on Machine Learning, pp. 7721–7735, PMLR, 2021\.
  * [40] A. D’Amour, K. Heller, D. Moldovan, B. Adlam, B. Alipanahi, A. Beutel, C. Chen, J. Deaton, J. Eisenstein, M. D. Hoffman, et al., “Underspecification presents challenges for credibility in modern machine learning,” Journal of Machine Learning Research, 2020.
  * [41] D. Teney, Y. Lin, S. J. Oh, and E. Abbasnejad, “Id and ood performance are sometimes inversely correlated on real-world datasets,” arXiv preprint arXiv:2209.00613, 2022.
  * [42] G. Blanchard, G. Lee, and C. Scott, “Generalizing from several related classification tasks to a new unlabeled sample,” Advances in neural information processing systems, vol. 24, 2011.
  * [43] H. Li, S. Pan, S. Wang, and A. Kot, “Domain generalization with adversarial feature learning,” 04 2018.
  * [44] I. Gulrajani and D. Lopez-Paz, “In search of lost domain generalization,” arXiv preprint arXiv:2007.01434, 2020.
  * [45] F. Qiao, L. Zhao, and X. Peng, “Learning to learn single domain generalization,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12556–12565, 2020.
  * [46] K. Zhou, Y. Yang, Y. Qiao, and T. Xiang, “Domain generalization with mixstyle,” 2021.
  * [47] J. Cha, S. Chun, K. Lee, H.-C. Cho, S. Park, Y. Lee, and S. Park, “Swad: Domain generalization by seeking flat minima,” 2021.
  * [48] K. Zhou, Z. Liu, Y. Qiao, T. Xiang, and C. C. Loy, “Domain generalization: A survey,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.
  * [49] K. He, H. Fan, Y. Wu, S. Xie, and R. Girshick, “Momentum contrast for unsupervised visual representation learning,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 9729–9738, 2020.
  * [50] T. Chen, S. Kornblith, M. Norouzi, and G. Hinton, “A simple framework for contrastive learning of visual representations,” in International conference on machine learning, pp. 1597–1607, PMLR, 2020.
  * [51] L. Ericsson, H. Gouk, and T. M. Hospedales, “How well do self-supervised models transfer?,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 5414–5423, 2021.
  * [52] L. Jing and Y. Tian, “Self-supervised visual feature learning with deep neural networks: A survey,” IEEE transactions on pattern analysis and machine intelligence, vol. 43, no. 11, pp. 4037–4058, 2020.
  * [53] X. Liu, F. Zhang, Z. Hou, L. Mian, Z. Wang, J. Zhang, and J. Tang, “Self-supervised learning: Generative or contrastive,” IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 1, pp. 857–876, 2021.
  * [54] B. Lake, R. Salakhutdinov, J. Gross, and J. Tenenbaum, “One shot learning of simple visual concepts,” in Proceedings of the annual meeting of the cognitive science society, vol. 33, 2011.
  * [55] B. M. Lake, R. Salakhutdinov, and J. B. Tenenbaum, “Human-level concept learning through probabilistic program induction,” Science, vol. 350, no. 6266, pp. 1332–1338, 2015.
  * [56] O. Vinyals, C. Blundell, T. Lillicrap, D. Wierstra, et al., “Matching networks for one shot learning,” Advances in neural information processing systems, vol. 29, 2016.
  * [57] C. Finn, P. Abbeel, and S. Levine, “Model-agnostic meta-learning for fast adaptation of deep networks,” in International conference on machine learning, pp. 1126–1135, PMLR, 2017.
  * [58] J. Snell, K. Swersky, and R. Zemel, “Prototypical networks for few-shot learning,” Advances in neural information processing systems, vol. 30, 2017\.
  * [59] F. Sung, Y. Yang, L. Zhang, T. Xiang, P. H. Torr, and T. M. Hospedales, “Learning to compare: Relation network for few-shot learning,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1199–1208, 2018.
  * [60] K. Lee, S. Maji, A. Ravichandran, and S. Soatto, “Meta-learning with differentiable convex optimization,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 10657–10665, 2019\.
  * [61] W.-Y. Chen, Y.-C. Liu, Z. Kira, Y.-C. F. Wang, and J.-B. Huang, “A closer look at few-shot classification,” arXiv preprint arXiv:1904.04232, 2019.
  * [62] Y. Tian, Y. Wang, D. Krishnan, J. B. Tenenbaum, and P. Isola, “Rethinking few-shot image classification: a good embedding is all you need?,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XIV 16, pp. 266–282, Springer, 2020.
  * [63] Y. Guo, N. C. Codella, L. Karlinsky, J. V. Codella, J. R. Smith, K. Saenko, T. Rosing, and R. Feris, “A broader study of cross-domain few-shot learning,” in Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXVII 16, pp. 124–141, Springer, 2020.
  * [64] Y. Zhang, Y. Zheng, X. Xu, and J. Wang, “How well do self-supervised methods perform in cross-domain few-shot learning?,” arXiv preprint arXiv:2202.09014, 2022.
  * [65] D. Das, S. Yun, and F. Porikli, “Confess: A framework for single source cross-domain few-shot learning,” in International Conference on Learning Representations, 2022.
  * [66] M. Assran, R. Balestriero, Q. Duval, F. Bordes, I. Misra, P. Bojanowski, P. Vincent, M. Rabbat, and N. Ballas, “The hidden uniform cluster prior in self-supervised learning,” arXiv preprint arXiv:2210.07277, 2022.
  * [67] M. Caron, I. Misra, J. Mairal, P. Goyal, P. Bojanowski, and A. Joulin, “Unsupervised learning of visual features by contrasting cluster assignments,” Advances in neural information processing systems, vol. 33, pp. 9912–9924, 2020.
  * [68] A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, et al., “Pytorch: An imperative style, high-performance deep learning library,” Advances in neural information processing systems, vol. 32, 2019.
  * [69] C. Szegedy, V. Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna, “Rethinking the inception architecture for computer vision,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2818–2826, 2016.
  * [70] H. Zhang, M. Cisse, Y. N. Dauphin, and D. Lopez-Paz, “mixup: Beyond empirical risk minimization,” arXiv preprint arXiv:1710.09412, 2017.
  * [71] E. D. Cubuk, B. Zoph, J. Shlens, and Q. V. Le, “Randaugment: Practical automated data augmentation with a reduced search space,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, pp. 702–703, 2020.
  * [72] H. Chefer, I. Schwartz, and L. Wolf, “Optimizing relevance maps of vision transformers improves robustness,” arXiv preprint arXiv:2206.01161, 2022\.
  * [73] Y. Wang, X. Shen, S. X. Hu, Y. Yuan, J. L. Crowley, and D. Vaufreydaz, “Self-supervised transformers for unsupervised object discovery using normalized cut,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 14543–14553, 2022.
  * [74] H. Chefer, S. Gur, and L. Wolf, “Generic attention-model explainability for interpreting bi-modal and encoder-decoder transformers,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 397–406, 2021\.
  * [75] S. Ruder, “An overview of gradient descent optimization algorithms,” arXiv preprint arXiv:1609.04747, 2016.
  * [76] D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” arXiv preprint arXiv:1412.6980, 2014.
  * [77] J. Mairal, “Cyanure: An open-source toolbox for empirical risk minimization for python, c++, and soon more,” arXiv preprint arXiv:1912.08165, 2019\.
  * [78] J. L. Ba, J. R. Kiros, and G. E. Hinton, “Layer normalization,” arXiv preprint arXiv:1607.06450, 2016.
  * [79] T. Salimans and D. P. Kingma, “Weight normalization: A simple reparameterization to accelerate training of deep neural networks,” Advances in neural information processing systems, vol. 29, 2016.
  * [80] E. Tzeng, J. Hoffman, N. Zhang, K. Saenko, and T. Darrell, “Deep domain confusion: Maximizing for domain invariance,” arXiv preprint arXiv:1412.3474, 2014.
  * [81] M. Long, Y. Cao, J. Wang, and M. Jordan, “Learning transferable features with deep adaptation networks,” in International conference on machine learning, pp. 97–105, PMLR, 2015.
  * [82] Y. Ganin and V. Lempitsky, “Unsupervised domain adaptation by backpropagation,” in International conference on machine learning, pp. 1180–1189, PMLR, 2015.
  * [83] E. Tzeng, J. Hoffman, K. Saenko, and T. Darrell, “Adversarial discriminative domain adaptation,” in Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 7167–7176, 2017.
  * [84] M. Long, Z. Cao, J. Wang, and M. I. Jordan, “Conditional adversarial domain adaptation,” Advances in neural information processing systems, vol. 31, 2018.
  * [85] J. Hoffman, E. Tzeng, T. Park, J.-Y. Zhu, P. Isola, K. Saenko, A. Efros, and T. Darrell, “Cycada: Cycle-consistent adversarial domain adaptation,” in International conference on machine learning, pp. 1989–1998, Pmlr, 2018\.
  * [86] D. Kim, K. Wang, S. Sclaroff, and K. Saenko, “A broad study of pre-training for domain generalization and adaptation,” in Computer Vision–ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23–27, 2022, Proceedings, Part XXXIII, pp. 621–638, Springer, 2022.
  * [87] J. Yang, J. Liu, N. Xu, and J. Huang, “Tvt: Transferable vision transformer for unsupervised domain adaptation,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp. 520–530, 2023.
  * [88] D. Kim, K. Saito, T.-H. Oh, B. A. Plummer, S. Sclaroff, and K. Saenko, “Cds: Cross-domain self-supervised pre-training,” in Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 9123–9132, 2021.
  * [89] K. Shen, R. M. Jones, A. Kumar, S. M. Xie, J. Z. HaoChen, T. Ma, and P. Liang, “Connect, not collapse: Explaining contrastive learning for unsupervised domain adaptation,” in International Conference on Machine Learning, pp. 19847–19878, PMLR, 2022.
  * [90] V. Prabhu, S. Yenamandra, A. Singh, and J. Hoffman, “Adapting self-supervised vision transformers by probing attention-conditioned masking consistency,” arXiv preprint arXiv:2206.08222, 2022.
  * [91] D. Wang, E. Shelhamer, S. Liu, B. Olshausen, and T. Darrell, “Tent: Fully test-time adaptation by entropy minimization,” arXiv preprint arXiv:2006.10726, 2020.
  * [92] Y. Liu, P. Kothari, B. Van Delft, B. Bellot-Gurlet, T. Mordan, and A. Alahi, “Ttt++: When does self-supervised test-time training fail or thrive?,” Advances in Neural Information Processing Systems, vol. 34, pp. 21808–21820, 2021.
  * [93] Q. Wang, O. Fink, L. Van Gool, and D. Dai, “Continual test-time domain adaptation,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7201–7211, 2022.
  * [94] S. Motiian, Q. Jones, S. Iranmanesh, and G. Doretto, “Few-shot adversarial domain adaptation,” Advances in neural information processing systems, vol. 30, 2017.
  * [95] A. Zhao, M. Ding, Z. Lu, T. Xiang, Y. Niu, J. Guan, and J.-R. Wen, “Domain-adaptive few-shot learning,” in Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision, pp. 1390–1399, 2021.
  * [96] W. Zhang, L. Shen, W. Zhang, and C.-S. Foo, “Few-shot adaptation of pre-trained networks for domain shift,” arXiv preprint arXiv:2205.15234, 2022.
  * [97] M. Yazdanpanah and P. Moradi, “Visual domain bridge: A source-free domain adaptation for cross-domain few-shot learning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2868–2877, 2022.

##  7 Fine-tuning details

###  7.1 Full-shot fine-tuning

We follow MSN [14] for linear-probing and MAE [13] for full fine-tuning of
standard models (see Sec. 8) on ImageNet [5]. For iWildCam [18] and Camelyon
[19] datasets, we follow the WILDS benchmark [12] for fine-tuning design
choices. We summarize some of these in table 6.

| ImageNet | iWildCam | Camelyon
---|---|---|---
Type | Linear | Full | Full
L2-normalization | True | False | False
Optimizer | SGD [75] | Adam [76] | SGD [75]
Scheduler | Cosine | None | None
Epochs | 100 | 12 | 10
Batch size | 128 | 16 | 32
Learning rate | 6.4 | 0.00001 | 0.001
Momentum | 0.9 | (0.9, 0.999) | 0.9
Weight decay | 0 | 0 | 0.01
Table 6: Fine-tuning design choices. We summarize some of the design choices
for linear probing on ImageNet and full fine-tuning on other datasets,
following [14] and [12].

###  7.2 Low-shot fine-tuning

For low-shot fine-tuning, we freeze the pre-trained models and train a
classifier on top with the available training data. Based on the BS-CDFSL
study [63], we compare the following classifiers and use the best performing
one in terms of in-domain (ID) performance for each dataset:

  * •

Logistic Regression [62]: Linear head is applied on feature embeddings
(optionally L2-normalized) and trained with a cross-entropy loss. We follow
the implementation of MSN [14] which uses (Resize, CenterCrop, Normalize)
augmentations and Cyanure [77] package for training and evaluation.

  * •

Mean-Centroid Classifier [58]: Cluster embeddings are obtained for each class
by averaging the feature embeddings of every image in the training data for
that class. Then, predicted label for a test image is the corresponding label
of the nearest (in terms of L2 distance) cluster center.

  * •

Baseline++ [61]: Also uses a linear head but the logits are obtained via
cosine similarity between the weights and the L2-normalized feature
embeddings. We match the original authors’ implementation which uses
(RandomResizedCrop, ImageJitter, RandomHorizontalFlip, Normalize)
augmentations and compare the remaining design choices with Logistic
Regression in table 7.

| LogReg [14] | Baseline++ [61]
---|---|---
Normalization | Layer norm [78] | Weight norm [79]
Optimizer |  auto [77] | SGD [75]
Epochs | 300 | 100
Learning rate | N/A | 0.01
Batch size | 16 | 16
Weight decay | 0.0025 | 0.001
Table 7: Classifier design choices. We summarize some of the design choices
for the different classifiers used for low-shot fine-tuning. LogReg stands for
Logistic Regression.

We show their comparison with MSN ViTS-16 on different datasets in table 8. On
average across low-shot regimes, Logistic Regression performs better on ID and
OOD shifts on ImageNet, better on ID shift and on-par (within 1 % point) on
OOD shift on iWildCam. However, Baseline++ performs better on ID and OOD
shifts on Camelyon.

| ImageNet accs. (Top-1) | iWildCam accs. (Avg.) | Camelyon accs. (Avg.)
---|---|---|---
| ID | OOD | ID | OOD | ID | OOD
Logistic Regression | 58.99 | 21.51 | 26.41 | 19.99 | 73.85 | 69.73
Mean Centroid Classifier | 57.46 | 20.5 | 24.33 | 20.72 | 81.12 | 70.26
Baseline++ | 48.6 | 21.10 | 17.74 | 14.62 | 83.62 | 75.66
Table 8: Classifier comparison across datasets. We compare the $3$ classifiers
– Logistic Regression [62, 14], Mean Centroid Classifier [58], and Baseline++
[61] – on average across low-shot regimes on different datasets with the MSN
ViTS-16 model. Logistic Regression performs better on both ID and OOD shifts
on ImageNet, better on ID shift and on-par on OOD shift on iWildCam. However,
Baseline++ performs better on both ID and OOD shifts on Camelyon.

Additional details for CLIP [4]. We use the ViTB-16 and RN50 models as they
have the closest number of parameters to the different models under
consideration as shown in table 11. As with the standard models, we freeze the
pre-trained models and train the classifiers (Baseline++ for Camelyon,
Logisitic Regression for others) with the available training data. We compare
the average performance on the low-shot regimes (see table 10) for these
models in table 9, and observe that ViTB-16 significantly outperforms RN50 on
all datasets. Hence we use it for additional experiments with the robustness
interventions.

For zero-shot results, we match the implementation of [16] who use a set of 80
and 2 prompts for ImageNet and iWildCam respectively. We use the prompt "a
photo of a <class> patch" for Camelyon where class $\in$ {normal, tumor}
following [12, 16]. More specifically, we initialize the final classification
layer of CLIP ViTB-16 with the zero-shot head constructed via these set of
prompts. Following [16], we also scale the head weights with CLIP’s
temperature parameter and L2-normalize its outputs before feeding them into
the zero-shot head.

| ImageNet accs. (Top-1) | iWildCam accs. (Avg.) | Camelyon accs. (Avg.)
---|---|---|---
| ID | OOD | ID | OOD | ID | OOD
CLIP ViTB-16 | 50.80 | 27.50 | 23.75 | 19.1 | 84.9 | 77.3
CLIP RN50 | 35.93 | 11.24 | 18.04 | 14.17 | 70.24 | 64.42
Table 9: Architecture comparison with CLIP [4]. We compare the CLIP ViTB-16
architecture with the RN50 variant on average across low-shot regimes. ViTB-16
significantly outperforms RN50 on both ID and OOD shifts.

##  8 Standard models and subsets

For obtaining the log-linear curve $\beta(x)$, we use the following subsets
and standard models, i.e. trained on ImageNet without additional robustness
interventions:

Dataset | Low-Shot Regimes (Imgs / Class)
---|---
Extreme | Low | Moderate | High
ImageNet [5] | $1$ | $2$ | $5$ | $\sim 13$
iWildCam [18] |  $1$-$480$ |  $1$-$2401$ |  $1$-$4802$ |  $1$-$9604$
Camelyon [19] | $1500$ | $3000$ | $7500$ | $15000$

Table 10: Different Low-Shot Regimes. We use the subsets described in this
table for fitting the curve $\beta(x)$ (see Eq. 5). Note that only the
extreme, moderate, and high low-shot regimes are used in the rest of our
experiments for simplicity.

ImageNet. We use the $1$, $2$, $5$, and $\sim$$13$ images per class subsets
provided by [14] for low-shot fine-tuning. The initializations and model sizes
used are:

  * •

MSN [14]: ViTS-16, ViTB-16, and ViTL-16

  * •

DINO [20]: RN50, ViTS-16, and ViTB-16

  * •

SwAV [67]: RN50 and RN50w2

Here, we only use the MSN ViTB-16 and DINO ViTB-16 models for the full-shot
regime due to limited compute.

iWildCam. We create subsets with images in $1\%$, $5\%$, $10\%$, and $20\%$
ratio of the original train shift in WILDS [12] benchmark while ensuring that
each of the $182$ classes have at least one image. These subsets have $1,370$,
$6,510$, $12,973$, and $25,931$ images respectively. The standard models used
for this dataset in all data regimes are:

  * •

MSN [14]: ViTS-16 and ViTB-16

  * •

DINO [20]: RN50, ViTS-16, and ViTB-16

  * •

SwAV [67]: RN50 and RN50w2

  * •

DEIT [22]: ViTS-16 and ViTB-16

  * •

Supervised RN50 [68]

Camelyon. We create subsets with $1,500$, $3,000$, $7,500$, and $15,000$
images per class from train shift in WILDS [12] benchmark for each of the $2$
classes. We use the same set of models as iWildCam for this dataset.

Model | Parameters
---|---
RN50 [68] | 23,508,032
CLIP RN50 [4] | 38,316,896
RN50w2 [22] | 93,907,072
ViTS-16 [22] | 21,664,896
ViTB-16 [22] | 85,797,120
ViTB-16 (IN21k) [3] | 86,389,248
CLIP ViTB-16 [4] | 57,844,224
ViTL-16 [22] | 303,299,584
Table 11: Parameter comparison. Comparison of number of trainable parameters
(without classifier) between different models in the same architecture family.

We summarize these subsets for all datasets in table 10. For simplicity, we
only use the extreme, moderate, and high low-shot regimes for the rest of our
experiments. Our code and low-shot subsets are publicly available at this url.

##  9 Robustness Interventions

We now describe the design choices and hyperparameters used for all
interventions. Our general strategy is to use the model checkpoint which (a)
trains to near completion, i.e a training accuracy of $98\%-100\%$ and (b)
leads to the highest in-distribution (ID) validation accuracy. Following [16]
who observe that models with similar ID performance can have vastly different
OOD performance, we generally use the smallest learning rate that meets these
criteria.

###  9.1 LP-FT [15]

LP-FT adopts a two-stage strategy of freezing the pre-trained model and
training a randomly initialized head, followed by full fine-tuning the entire
model. We mostly follow table 6 for the values of different hyperparameters
except for the ones described below.

ImageNet. We use the linear probing (LP) hyperparameters provided by MSN [14]
as also shown in table 6. For full fine-tuning in the full-shot regime, we use
the MAE codebase [13] and fine-tune for $20$ epochs. In the low-shot regimes,
we use the hyperparameters shown in table 6 except a learning rate of $0.0001$
for LP-FT following [15].

iWildCam. We do a grid search over the number of epochs ($ep$), learning rate
($lr$), and weight decay ($wd$) for linear probing and find a combination of
$(120,0.001,0.001)$ to work well across models and data regimes. For ImageNet
pre-trained models, we linear probe for $240$ epochs in low-shot regimes and
use a combination of $(ep=12,lr=0.00001,wd=0)$ for full fine-tuning. As the
intervention is primarily meant for CLIP, we do a grid search over
($ep\in\\{12,24\\},lr\in\\{0.00001,0.000001\\},wd\in\\{0.001,0.01,0.0\\}$) and
select the checkpoint with the best ID validation performance.

Camelyon. We do a grid search over the number of epochs, learning rate, and
weight decay for linear probing and find a combination of
$(ep=20,lr=0.001,wd=0.001)$ to work well across models and data regimes. For
ImageNet pre-trained models, we find a combination of
$(ep=12,lr=0.0001,wd=0.01)$ to work well. As for CLIP, we do a grid search
over
($ep\in\\{10,20\\},lr\in\\{0.00001,0.000001\\},wd\in\\{0.001,0.01,0.0\\}$) and
select the checkpoint with the best ID validation performance.

###  9.2 WiSE-FT [16]

WiSE-FT ensembles between the weights of a zero-shot model such as CLIP and
this model fine-tuned in the full-shot regime. The method has a mixing
coefficient $\alpha$ which determines the relative weight assigned to the
fine-tuned model with respect to the zero-shot model, i.e.
$\theta=(1-\alpha)\cdot\theta_{0}+\alpha\cdot\theta_{1}$ where
$\theta,\theta_{0},\theta_{1}$ refer to the weights of the model after
ensembling, the zero-shot model, and the fine-tuned model respectively.

Since ImageNet pre-trained models such as MSN don’t have a zero-shot head, we
use LP and LP-FT models (see Sec. 9.1) for the weight space ensemble. For
CLIP, we ensemble between the weights of the pre-trained model with a zero-
shot head (see Sec. 7.2) and this model fine-tuned fully. For ImageNet, we use
the same hyperparameters described in section 7 except a learning rate of
$0.00001$ in the low-shot regimes for better ID performance. Otherwise, we
perform a grid search over hyperparameters as for LP-FT (see Sec. 9.1) and
select the best ID validation checkpoint.

Following [16], we use an $\alpha=0.5$ unless mentioned otherwise. With CLIP
on Camelyon, we search over $\alpha\in\\{0,0.5,1\\}$ and report the $\alpha$
which achieves the highest ID validation performance, i.e. $\alpha=1$. We show
this comparison with along the OOD performances in table 12.

| Camelyon accs. (Avg.)
---|---
| ID | OOD
Full-Shot |  |
$\alpha=0$ | 50.48 | 51.55
$\alpha=0.5$ | 75.68 | 70.60
$\alpha=1$ | 99.47 | 94.27
(Average) Low-Shot |  |
$\alpha=0$ | 50.48 | 51.55
$\alpha=0.5$ | 61.33 | 59.98
$\alpha=1$ | 91.18 | 87.71
Table 12: WiSE-FT [16] $\alpha$ comparison. We compare the ID and OOD
performances of WiSE-FT with CLIP for different $\alpha$ values on Camelyon
dataset. $\alpha=1$ results in significantly better performance across data
regimes.

###  9.3 Model Soups [17]

Model Soups performs a weight space ensemble with several models that are
fine-tuned with different set of augmentations and optimizer configurations.
The associated hyperparameters for each model in the soup are chosen randomly,
and the value ranges following [17] are shown in table 13. Due to limited
compute, we use a greedy soup 555We find that this version of the soup
performed substantially better than the uniform soup on iWildCam [18] dataset
in all data regimes. of $9$ models for our experiments in which a fine-tuned
model is greedily added to the soup only if its ID performance is enhanced
after adding the current model to the soup.

| Value Range |
---|---|---
Epochs | [$4,16$] |
Learning Rate | [$10^{-4}$,$10^{-6}$] |
Weight Decay | [$10^{-0.2}$,$10^{-4}$] |
Label Smoothing [69] | [0,0.25] |
Mixup [70] | [0,0.9] |
RandAug [71] $M$ | [0,20] |
RandAug [71] $N$ | [0,2] |
Table 13: Model Soups [17] hyperparameters. Value ranges for each
hyperparameter used in the random search.

###  9.4 RobustViT [72]

RobustViT uses an unsupervised localization method such as TokenCut [73] to
dump offline segmentation maps and then optimizes a supervised ViT’s saliency
maps [74] to resemble the offline ones while maintaining its classification
accuracy to its improve robustness on the OOD shifts for ImageNet [7, 8, 9,
10, 11].

First, we use TokenCut to dump the segmentation maps for each of the images in
the $1$, $5$ and $\sim$$13$ images per class subsets. Then, we follow the
original authors’ implementation for fine-tuning with the proposed
augmentations, losses, and hyperparameters. However, we find that these lead
to poor performance for self-supervised (SSL) ViTs such as MSN ViTB-16, likely
due to the absence of a classification head for such models.

Thus, we first perform a linear probing step with the hyperparameters used for
LP-FT and described in section 9.1 for $50$ epochs, and then perform the
proposed fine-tuning with the default hyperparameters. For the full-shot
regime, we use our fine-tuned model checkpoint (see Sec. 7) and directly
perform the proposed fine-tuning step with the $2$ images per class subset, as
it’s close to the number of images used in [72]. We find this strategy to work
well which significantly improves robustness of MSN ViTB-16 across data
regimes, as shown in table 5 in the main paper.

For datasets other than ImageNet and especially Camelyon which is non object-
centric, we note that the method remains challenging to implement primarily
due to the need of offline segmentation maps.

##  10 Measuring significance for robustness.

The effective ($\rho$) and relative ($\tau$) robustness metrics [7, 36, 16]
can be used to determine whether a robustness intervention $r$ applied on a
standard model $f^{s}$, i.e. $f^{r}$ improves robustness or not (see Sec. 3 in
main paper). However, these metrics don’t inform whether an intervention which
improves robustness does so significantly or not. An intervention $r$ can
technically improve robustness but barely so, i.e. $\rho,\tau\rightarrow
0^{+}$. Also, the quality of curve fit $\beta(x)$ could be poor (table 4 in
main paper) due to which a simple strategy such as $\rho>\rho_{0}\text{ and
}\tau>\tau_{0}$ for some $\rho_{0}\text{ and }\tau_{0}$ might not be suitable.
Therefore, we use the standard deviation of the points used to fit the curve
$\beta(x)$ for measuring significance.

Specifically, given a set $S$ of in-domain (ID) and out-of-distribution (OOD)
accuracies of $n$ standard models, i.e.

$S=\\{(acc^{k}_{id},acc^{k}_{ood})\;\forall\,k\,\in[n]\\}$ (4)

Recall that log-linear curve $\beta(x)$ is defined as:

$\beta(x)=\sigma(w\text{ logit}(x)+b)$ (5)

where $\text{logit}(x)=\ln{\frac{1}{1-x}}$ and $\sigma$ is the inverse of the
logit function. Each point in set $S$ is mapped by $\text{logit}(x)$ and
$\beta(x)$ is obtained by using the mapped points to solve linear regression.
Next, we obtain the set of residuals $R$ as:

$R=\\{\text{logit}(acc^{k}_{ood})-(w\text{
logit}(acc^{k}_{id})+b)\;\forall\,k\in[n]\\}$ (6)

We then compute the standard deviation $d$ of the set of residuals $R$ as:

$d=\sqrt{\frac{\sum_{k=1}^{n}R_{k}^{2}}{n-2}}$ (7)

Next, we define $\beta_{\lambda}(x)$ which can be thought of as a shifted
version of $\beta(x)$, as:

$\beta_{\lambda}(x)=\sigma(w\,x+b+\lambda\,d)$ (8)

Finally, we say that an intervention $r$ applied on a standard model $f^{s}$,
i.e. $f^{r}=(acc^{r}_{id},acc^{r}_{ood})$ significantly improves robustness if
both the following conditions hold:

$\displaystyle acc^{r}_{ood}>\beta_{\lambda}(acc^{r}_{id})$ (9) $\displaystyle
acc^{r}_{ood}>acc^{s}_{ood}+\gamma$ (10)

where $\lambda\text{ and }\gamma$ can be arbitrary, but we opt for
$\lambda=1\text{ and }\gamma=0$ for a milder definition of significance. We
provide the values for $w$, $b$, and $d$ to define $\beta(x)$ and
$\beta_{\lambda}(x)$ for each dataset in table 16.

Intuitively, we ask whether the intervention provides an OOD accuracy that is
(1) one standard deviation beyond the OOD accuracy that can be expected from
its ID accuracy after logit transform and (2) better than the OOD accuracy of
the standard model without the intervention (or $\tau>0$). Across multiple
data regimes, an intervention is said to significantly improve robustness if
it does so (Eq. 9 and 10) in the full-shot regime and on majority of low-shot
regimes.

| ImageNet | iWildCam | Camelyon
---|---|---|---
| $\rho\uparrow$ | $\tau\uparrow$ | $\rho\uparrow$ | $\tau\uparrow$ | $\rho\uparrow$ | $\tau\uparrow$
Full-Shot Regime |  |  |  |  |  |
1 LP-FT [15] | 5.16 | -0.61 | -1.41 | -0.17 | -0.45 | 7.48
2 \+ CLIP | 19.60∗ | $\text{13.77}^{*}$ | -3.60 | -6.09 | 0.37 | 11.28
3 WiSE-FT [16] | 6.66 | -0.86 | -3.84 | -5.87 | 6.22 | 12.66
4 \+ CLIP | $\text{22.24}^{*}$ | $\text{16.41}^{*}$ | 3.98 | 4.78 | 2.85 | 14.18
5 Model Soups [16] | 0.53 | -10.58 | -0.93 | -0.14 | -0.35 | 11.68
6 \+ CLIP | $\text{11.00}^{\dagger}$ | $\text{4.29}^{\dagger}$ | 3.20 | -4.84 | 5.93 | 9.50
7 RobustViT [72] | 6.73 | 1.13 | N/A | N/A | N/A | N/A
8 CLIP zero-shot [4, 16] | 30.28 | 10.79 | 8.46 | -23.17 | -14.63 | -28.54
Extreme Low-Shot |  |  |  |  |  |
9 LP-FT [15] | 3.71 | 1.75 | -0.62 | 0.317 | 6.04 | 2.46
10 \+ CLIP | 13.85 | 4.51 | 3.59 | 6.24 | 9.30 | 8.35
11 WiSE-FT [16] | 5.93 | 3.94 | -1.09 | 0.00 | 5.62 | 2.44
12 \+ CLIP | 29.90 | 39.17 | 6.87 | 7.81 | -4.03 | -4.89
13 Model Soups [17] | 6.37 | 4.41 | -1.74 | -0.37 | 5.93 | 2.93
14 \+ CLIP | 14.60 | 5.10 | 0.56 | 2.63 | 6.59 | 9.64
15 RobustViT [72] | 6.82 | 5.32 | N/A | N/A | N/A | N/A
16 CLIP zero-shot [4, 16] | 30.28 | 38.68 | 8.46 | 2.59 | -14.63 | -27.41
Moderate Low-Shot |  |  |  |  |  |
17 LP-FT [15] | 0.28 | 1.97 | -0.27 | 2.62 | -0.01 | -3.15
18 \+ CLIP | 17.76 | 15.57 | -0.46 | 3.82 | 0.07 | -3.20
19 WiSE-FT [16] | 3.25 | 4.90 | 3.51 | 3.96 | -0.37 | -2.77
20 \+ CLIP | 29.22 | 33.99 | 7.81 | 10.55 | 7.61 | 7.51
21 Model Soups [17] | 3.06 | 4.58 | 2.12 | 2.99 | -0.17 | -1.96
22 \+ CLIP | 21.37 | 17.82 | -0.24 | 1.39 | 4.22 | -0.77
23 RobustViT [72] | 4.38 | 5.70 | N/A | N/A | N/A | N/A
24 CLIP zero-shot [4, 16] | 30.28 | 33.21 | 8.46 | -4.45 | -14.63 | -27.41
High Low-Shot |  |  |  |  |  |
25 LP-FT [15] | -0.39 | 2.70 | -0.98 | 6.21 | 2.14 | 0.99
26 \+ CLIP | 17.12 | 19.11 | 1.62 | 6.38 | -2.39 | -5.53
27 WiSE-FT [16] | 2.24 | 5.44 | -2.93 | 3.65 | 2.34 | 1.87
28 \+ CLIP | 28.20 | 32.77 | 4.35 | 11.92 | 6.81 | 10.55
29 Model Soups [17] | 2.21 | 5.27 | -0.41 | 5.57 | 2.72 | 2.84
30 \+ CLIP | 21.65 | 21.94 | 0.18 | 1.48 | 5.40 | 4.50
31 RobustViT [72] | 2.68 | 5.51 | N/A | N/A | N/A | N/A
32 CLIP zero-shot [4, 16] | 30.28 | 31.79 | 8.46 | -6.643 | -14.63 | -25.83
Table 14: Robustness intervention comparison.  The table shows effective ($\rho$) and relative ($\tau$) robustness of different interventions in the full-shot and low-shot regimes. $*$ and $\dagger$ denote numbers obtained from papers for ViTB-16 and ViTB-32 architecture respectively. Interventions that do not improve robustness in the full-shot regime are shown in gray, while interventions that do so are shown in black. Interventions that significantly improve robustness in both the full-shot regime and majority of low-shot regimes are highlighted in blue for each dataset. Most interventions significantly improve robustness on ImageNet but not on other datasets. Only WiSE-FT with CLIP significantly improves robustness across datasets and data regimes. Absolute performances for computing $\tau$ are shown in table 17.  Figure 7: Effect of robustness interventions on ImageNet. Plots (a), (b), and (c) show performance of interventions in low-shot regimes (see table 10). Plot (d) shows performance of interventions in the full-shot regime. Interventions located above the black line ($\rho>0$) and in the blue region ($\tau>0$) are said to improve robustness. Interventions located above the red line and in the blue region are said to significantly improve robustness (see Sec. 10). Interventions that significantly improve robustness are shown as opaque, whereas the ones that only improve robustness are shown as translucent. Most interventions significantly improve robustness across data regimes.  Figure 8: Effect of robustness interventions on iWildCam. Interventions often fail to improve robustness in both the full and low-shot regimes with MSN ViTB-16. Only WiSE-FT with CLIP ViTB-16 significantly improves robustness in all data regimes.  Figure 9: Effect of robustness interventions on Camelyon. Interventions often improve robustness in the full-shot regime with both MSN and CLIP ViTB-16 but fail to do so in extreme or moderate low-shot regimes for these models. Only WiSE-FT with CLIP significantly improves robustness across data regimes. Table 14 shows effective and relative robustness of interventions for further comparison.  | ImageNet | iWildCam | Camelyon
---|---|---|---
| $\rho\uparrow$ | $\tau\uparrow$ | $\rho\uparrow$ | $\tau\uparrow$ | $\rho\uparrow$ | $\tau\uparrow$
Full-Shot Regime |  |  |  |  |  |
1 LP-FT [15] | 6.83 | -0.57 | 2.06 | -0.34 | 1.44 | 8.57
2 \+ CLIP | 19.60∗ | 12.52∗ | -3.60 | -9.09 | 0.37 | 9.54
3 WiSE-FT [16] | 9.19 | -19.16 | 1.85 | -5.06 | 4.08 | 10.13
4 \+ CLIP | 22.24∗ | 15.16∗ | 3.98 | 1.77 | 2.85 | 12.44
5 Model Soups + CLIP [16] | 11.00† | 3.04† | 3.20 | -7.84 | 5.93 | 7.75
7 RobustViT [72] | 6.34 | 0.87 | N/A | N/A | N/A | N/A
8 CLIP zero-shot [4, 16] | 30.28 | 10.79 | 8.46 | -23.17 | -14.63 | -28.54
Extreme Low-Shot |  |  |  |  |  |
9 LP-FT [15] | 7.10 | 2.95 | 2.04 | 4.59 | 9.23 | -0.97
10 \+ CLIP | 13.85 | 6.37 | 3.56 | 6.69 | -4.03 | -12.20
11 WiSE-FT [16] | 7.34 | 3.08 | 0.52 | 2.86 | 9.66 | -0.71
12 \+ CLIP | 29.90 | 41.04 | 6.87 | 9.71 | 6.59 | 2.23
13 Model Soups + CLIP [17] | 14.60 | 6.97 | 0.56 | 3.08 | 2.54 | -10.09
15 RobustViT [72] | 8.95 | 5.41 | N/A | N/A | N/A | N/A
16 CLIP zero-shot [4, 16] | 30.28 | 38.68 | 8.46 | 2.59 | -14.63 | -27.41
Moderate Low-Shot |  |  |  |  |  |
17 LP-FT [15] | 5.45 | 5.14 | 0.49 | 5.22 | 4.83 | -4.37
18 \+ CLIP | 17.76 | 16.16 | -0.46 | 3.17 | 0.07 | -8.12
19 WiSE-FT [16] | 7.16 | 6.10 | -0.61 | 4.50 | 6.56 | -2.32
20 \+ CLIP | 29.22 | 34.58 | 7.81 | 9.90 | 7.61 | 2.59
21 Model Soups + CLIP [17] | 21.37 | 18.41 | -0.24 | 0.74 | 4.22 | -5.69
23 RobustViT [72] | 8.39 | 7.77 | N/A | N/A | N/A | N/A
24 CLIP zero-shot [4, 16] | 30.28 | 33.21 | 8.46 | -4.45 | -14.63 | -27.41
High Low-Shot |  |  |  |  |  |
25 LP-FT [15] | 3.61 | 4.71 | 1.51 | 6.44 | 4.33 | -2.51
26 \+ CLIP | 17.12 | 19.15 | 1.62 | 6.06 | -2.39 | -10.84
27 WiSE-FT [16] | 4.99 | 5.87 | 2.76 | 5.57 | 4.66 | -2.25
28 \+ CLIP | 28.20 | 32.81 | 4.35 | 11.60 | 6.81 | 5.24
29 Model Soups + CLIP [17] | 21.65 | 21.98 | 0.18 | 1.16 | 5.40 | -0.81
31 RobustViT [72] | 6.93 | 8.42 | N/A | N/A | N/A | N/A
32 CLIP zero-shot [4, 16] | 30.28 | 31.79 | 8.46 | -6.643 | -14.63 | -25.83
Table 15: Robustness intervention comparison with DINO ViTB [20] as reference.
The table shows effective ($\rho$) and relative ($\tau$) robustness of
different interventions in the full-shot and low-shot regimes when applied on
DINO ViTB-16. $*$ and $\dagger$ denote numbers obtained from papers for
ViTB-16 and ViTB-32 architecture respectively. Interventions that do not
improve robustness in the full-shot regime are shown in gray, while
interventions that do so are shown in black. Interventions that significantly
improve robustness in both the full-shot regime and majority of low-shot
regimes are highlighted in blue for each dataset. As with MSN (see table 14),
most interventions significantly improve robustness on ImageNet but not on
other datasets. Only WiSE-FT with CLIP significantly improves robustness
across datasets and data regimes. Absolute performances for computing $\tau$
are shown in table 17.  Figure 10: Effect of robustness interventions on
ImageNet with DINO [20] as reference. Plots (a), (b), and (c) show performance
of interventions in low-shot regimes (see table 10). Plot (d) shows
performance of interventions in the full-shot regime. Interventions located
above the black line ($\rho>0$) and in the blue region ($\tau>0$) are said to
improve robustness. Interventions largely improve robustness in low-shot
regimes with DINO ViTB-16 and in all data regimes when coupled with CLIP
ViTB-16.  Figure 11: Effect of robustness interventions on iWildCam with DINO
[20] as reference. Interventions often improve robustness in the low-shot
regimes but not in the full-shot regime with DINO. Only WiSE-FT with CLIP
improves robustness in all data regimes.  Figure 12: Effect of robustness
interventions on Camelyon with DINO [20] as reference. Interventions often
improve robustness in the full-shot regime with both DINO and CLIP ViTB-16 but
often fail to do so in the low-shot regimes, except WiSE-FT with CLIP. Table
15 shows effective and relative robustness of interventions with DINO ViTB-16
for further comparison.

We show the effective and relative robustness of the interventions in all
datasets and data regimes in table 14. By default, we use MSN [14] as
reference and ViTB-16 models for applying interventions. To complement these
results and our findings in the main paper, we obtain the curve
$\beta_{\lambda}(x)$ (see Eq. 8) for measuring significance. Table 16 shows
the obtained parameter values for the different datasets.

We summarize the results for ImageNet in Fig. 7, iWildCam in Fig. 8, and
Camelyon in Fig. 9. While most interventions significantly improve robustness
on ImageNet across data regimes, they fail to do so on iWildCam and Camelyon
datasets. WiSE-FT with CLIP is the only intervention which significantly
improves robustness across the different datasets and data regimes.

For completeness, we also report the mean and standard deviation of some
interventions with CLIP across $2$ different runs on iWildCam and Camelyon
datasets in table 18. It can be seen that OOD variation can be high even when
ID variation is small, as also observed by [16]. Surprisingly, Model Soups
generally exhibits the smallest variance even though it’s hyperparameters are
sampled randomly as shown in table 13. However, WiSE-FT often leads to much
better performance with relatively small variance.

Dataset | Parameters for $\beta_{\lambda}(x)$
---|---
$w$ | $b$ | $d$
ImageNet [5] | 0.825 | -1.609 | 0.136
iWildCam [18] | 0.850 | -0.496 | 0.128
Camelyon [19] | 0.325 | 0.665 | 0.268
Table 16: Parameters for $\beta_{\lambda}(x)$. For each dataset, we list the
values for $w$, $b$, and $d$ to obtain the function $\beta_{\lambda}(x)$ (see
Eq. 8)

Data Regime | ImageNet | iWildCam | Camelyon
---|---|---|---
MSN | DINO | MSN | DINO | MSN | DINO
Full-Shot Regime | 46.57 | 47.82 | 39.98 | 42.99 | 80.09 | 81.83
Extreme Low-Shot | 18.69 | 14.15 | 14.22 | 13.77 | 79.10 | 86.41
Moderate Low-Shot | 24.16 | 20.60 | 21.26 | 21.91 | 78.96 | 83.88
High Low-Shot | 25.58 | 22.51 | 23.46 | 23.78 | 77.38 | 82.69

Table 17:  OOD performances of reference models.  The table shows the OOD
performances of MSN and DINO ViTB-16 used to compute relative robustness
$\tau$ in tables 14 and 15.

Data Regime | iWildCam | Camelyon
---|---|---
ID | OOD | ID | OOD
Full-Shot |  |  |  |
WiSE-FT + CLIP | 53.18 $\pm$ 0.42 | 44.92 $\pm$ 0.16 | 99.46 $\pm$ 0.01 | 94.41 $\pm$ 0.14
LP-FT + CLIP | 49.85 $\pm$ 0.31 | 33.89 $\pm$ 1.78 | 99.22 $\pm$ 0.16 | 87.71 $\pm$ 3.65
Model Soups + CLIP | 42.39 $\pm$ 0.00 | 35.14 $\pm$ 0.00 | 95.17 $\pm$ 0.01 | 89.58 $\pm$ 0.01
Extreme Low-Shot |  |  |  |
WiSE-FT + CLIP | 19.81 $\pm$ 1.36 | 22.89 $\pm$ 0.59 | 93.17 $\pm$ 0.24 | 88.91 $\pm$ 0.17
LP-FT + CLIP | 19.86 $\pm$ 1.68 | 19.88 $\pm$ 0.58 | 87.57 $\pm$ 0.66 | 80.80 $\pm$ 6.59
Model Soups + CLIP | 20.70 $\pm$ 0.01 | 16.84 $\pm$ 0.01 | 75.73 $\pm$ 0.01 | 76.18 $\pm$ 0.10
Moderate Low-Shot |  |  |  |
WiSE-FT + CLIP | 31.75 $\pm$ 0.16 | 31.57 $\pm$ 0.25 | 89.25 $\pm$ 1.11 | 86.83 $\pm$ 0.36
LP-FT + CLIP | 32.64 $\pm$ 1.09 | 23.93 $\pm$ 1.16 | 81.27 $\pm$ 0.29 | 76.78 $\pm$ 1.02
Model Soups + CLIP | 28.28 $\pm$ 1.27 | 22.65 $\pm$ 0.31 | 76.65 $\pm$ 0.26 | 78.71 $\pm$ 0.36
High Low-Shot |  |  |  |
WiSE-FT + CLIP | 41.70 $\pm$ 0.52 | 35.44 $\pm$ 0.06 | 91.03 $\pm$ 0.95 | 87.78 $\pm$ 0.16
LP-FT + CLIP | 37.09 $\pm$ 0.3 | 29.78 $\pm$ 0.07 | 76.13 $\pm$ 0.94 | 71.03 $\pm$ 0.82
Model Soups + CLIP | 31.29 $\pm$ 0.98 | 25.09 $\pm$ 0.11 | 80.95 $\pm$ 1.91 | 81.03 $\pm$ 0.60

Table 18: Performance variance. We report the mean and std. deviation of some
interventions with CLIP across $2$ runs. Model Soups generally exhibits the
smallest variance but WiSE-FT often leads to much better performance with
relatively small variance.

##  11 Results for other initializations.

We might ask how dependent our observations are on the choice of the reference
model, i.e. MSN ViTB-16 and whether other initializations result in the same
set of observations. To answer this, we apply the interventions described in
Sec. 9 on DINO ViTB-16. The absolute out-of-distribution (OOD) performances
with both models are shown in table 17. We omit Model Soups with DINO from
this experiment due to limited compute. The dataset-wise observations are
described below.

ImageNet. We show the results of this experiment in Fig. 10. Similar to the
findings for MSN, interventions are largely effectively and relatively robust
in the low-shot regimes when coupled with DINO. RobustViT also improves
robustness in all data regimes. With CLIP ViTB-16, intervention are
effectively and relatively robust in all data regimes. As shown in table 15,
zero-shot CLIP improves robustness on ImageNet but often fails to do so on
other datasets and data regimes.

iWildCam. We show the results of this experiment in Fig. 11. With DINO,
interventions are often effectively and relatively robust in the low-shot
regimes but neither effectively nor relatively robust in the full-shot regime.
As with MSN, WiSE-FT with CLIP is the only intervention which improves
robustness in all data regimes.

Camelyon. We show the results of this experiment in Fig. 12. As with MSN, most
interventions improve robustness in the full-shot regime and WiSE-FT with CLIP
does so in all data regimes. However, unlike MSN, other interventions fail to
be relatively robust in all low-shot regimes instead of just the extreme or
moderate low-shot regimes.

To complement our findings, we also show the effective and relative robustness
of the interventions on different datasets and data regimes in table 15. We
follow the same procedure for measuring significance as described in Sec. 10.
Consistent with the findings for MSN, we see that (1) most interventions
significantly improve robustness on ImageNet but not on other datasets and (2)
no intervention significantly improves robustness across datasets and data
regimes, except WiSE-FT with CLIP. Overall, our findings hold for multiple
initializations and show that robustness to natural shifts on ImageNet and in
full-shot regimes might not imply that on other datasets and in the low-shot
regimes.

##  12 Related works

We describe additional related works that we were unable to include in the
main paper due to space constraints. Domain adaptation. Domain adaptation (DA)
seeks to transfer a model trained on a source domain to an unseen target
domain. When the target domain doesn’t have labels, the setting is referred to
as unsupervised domain adaptation (UDA) which has been extensively studied
[80, 81, 82, 83, 84, 85, 86, 87]. While a large body of works rely on
supervised ImageNet initializations for UDA, some works have focused on self-
supervised adaptation with CNNs [88, 89] and ViTs [90]. Recent works have also
studied test-time adaptation [91, 92, 93] which focuses on online learning,
and few-shot adaptation [94, 95, 96, 97] which is often similar to the CD-FSL
setting. Crucially, robustness studies and our study differs from DA and these
works by not assuming access to the target data.