# Is Synthetic Data all We Need?
Benchmarking the Robustness of Models Trained with Synthetic Images

Krishnakant Singh1 Thanush Navaratnam∗,1 Jannik Holmer∗,1 Simone Schaub-
Meyer1,2 Stefan Roth1,2

1 Department of Computer Science, TU Darmstadt 2 hessian.AI

###### Abstract

A long-standing challenge in developing machine learning approaches has been
the lack of high-quality labeled data. Recently, models trained with purely
synthetic data, here termed _synthetic clones_ , generated using large-scale
pre-trained diffusion models have shown promising results in overcoming this
annotation bottleneck. As these synthetic clone models progress, they are
likely to be deployed in challenging real-world settings, yet their
suitability remains understudied. Our work addresses this gap by providing the
first benchmark for three classes of synthetic clone models, namely
supervised, self-supervised, and multi-modal ones, across a range of
robustness measures. We show that existing synthetic self-supervised and
multi-modal clones are comparable to or outperform state-of-the-art real-image
baselines for a range of robustness metrics – shape bias, background bias,
calibration, _etc_. However, we also find that synthetic clones are much more
susceptible to adversarial and real-world noise than models trained with real
data. To address this, we find that combining both real _and_ synthetic data
further increases the robustness, and that the choice of prompt used for
generating synthetic images plays an important part in the robustness of
synthetic clones.

††footnotetext: Corresponding author<EMAIL_ADDRESS>darmstadt.de**footnotetext: Joint second authors with equal contribution.
These authors were responsible for the initial version of common corruption
experiments.

##  1 Introduction

Most modern machine learning methods are bottlenecked in performance by the
quality and quantity of labeled data. Several works [39, 43, 5] have shown
that the generalization error of neural networks follows the neural scaling
law with respect to the dataset size, _i.e_. the test error reduces linearly
with the log of the dataset size. Moreover, the datasets’ diversity [53] and
fairness [63] are also factors that play an important role in the
generalization performance of modern neural networks. Unfortunately, curating
diverse, fair, and large datasets is time-consuming and expensive.

|  |
---|---|---
Supervised | Self-supervised | Multi-modal
Figure 1: Robustness of synthetic clones _vs_. real-image baselines for
different model classes. Self-supervised and multi-modal synthetic clones are
close in performance on various robustness measures to baseline models trained
on real images. All synthetic clones suffer in performance w.r.t. adversarial
and common corruption robustness.

The advent of large-scale image generation models like Stable Diffusion [64]
has revived the interest in utilizing generated images to train models for
various downstream tasks in hopes of alleviating the need for high-quality
annotations. Models like [67, 89, 22] use only generated images from Stable
Diffusion for supervised training of a downstream classifier. [73, 31, 22]
show that it is also possible to train self-supervised models like SimCLR [14]
and multi-modal models like CLIP [60] using _only_ synthetic images and
prompts. These models can match or outperform their counterparts trained on
real data for downstream tasks like classification and segmentation. We term
such models that are trained using only generated data as _synthetic clones_.

Modern machine learning models are increasingly employed in solving real-world
problems like autonomous driving and automated medical assistance [9]. With
the rapid progress of using synthetic data for training models, it is
imperative that we understand how robust these models are before deploying
them in the real world. Recent work on synthetic clones [22, 73, 67] has not
focused on evaluating the robustness of these models. Yet, models trained on
synthetic or generated datasets have been known to suffer from shortcomings
such as model collapse [70, 19], _i.e_. when the model forgets the long tail
classes or learns a different distribution than the training dataset.

Our work aims to provide a comprehensive benchmark for the robustness of
synthetic clone models compared to state-of-the-art (SOTA) baseline models
that are trained on real image datasets. We benchmark three classes of
synthetic clone models – supervised [67, 22], self-supervised [73], and multi-
modal [22] ones – against nine strong baseline models trained using real
images. We evaluate robustness metrics regarding shape, background, and
context bias. We also benchmark these models against adversarial and common
image corruptions. Finally, we test how well these models are calibrated in
comparison to models trained with real data. Our results are visually
summarized in Fig. 1.

To overcome some of the drawbacks of using synthetic data alone, we conduct
extensive ablations regarding how the robustness of synthetic clones changes
with _(i)_ joint training with synthetic and real data, _(ii)_ increasing the
number of synthetic samples, and _(iii)_ the effect of prompts when generating
images with Stable Diffusion.

Let us summarize our findings: _(i)_ On many robustness metrics (calibaration,
background bias, shape bias, _etc_.) self-supervised and multi-modal models
trained on synthetic data perform on par with their counterparts trained on
real imagery. _(ii)_ Supervised synthetic models, on the other hand, lag
behind baselines trained on real datasets w.r.t. several key robustness
measures like calibration, OOD detection, adversarial robustness, _etc_.
_(iii)_ Synthetic clones are much more vulnerable to adversarial and common
corruption than models trained with real images. _(iv)_ A mixture of real and
synthetic data is the best combination for obtaining robustness. _(v)_ The
choice of prompt for image generation plays a crucial role in the robustness
of synthetic clones.

##  2 Related Work

#### Self-supervised learning (SSL)

methods [34, 33, 7, 12] have emerged as promising alternatives to solve the
data annotation bottleneck. These models learn by solving pretext tasks like
context prediction [18], image denoising [79], patch prediction [18], and many
others [87, 56, 86, 11, 59]. In recent years, they have come increasingly
close to supervised models. For example, the downstream classification
accuracy for DINOv2 [57] with supervised linear probing is 84.5% (using ViT-B)
while that of EfficientNet [84], a strong supervised model, is 88.4% on the
ImageNet-1K dataset [15]. However, SSL methods suffer from scaling issues,
_i.e_. augmenting an already large-scale dataset in size has little effect on
the model performance [29]. Another approach is using large-scale uncurated
multimodal web data [60]. However, this data is often noisy, biased, and
limited in diversity (_e.g_., certain concepts may have only a few data points
[24, 58]).

Generative neural networks are a class of models that, given random noise
samples, learn to transform these noise samples into data. Modern generative
models can broadly be categorized into _implicit models_ , such as GANs [27,
3, 10, 45] and diffusion-based models [40, 72], or _explicit models_ like
normalizing flows [13, 17] and VAEs [48, 77]. Diffusion models are SOTA for
image generation since they address the limited diversity and image quality
issues, which impaired the use of previous generative models [83].

Synthetic data has found usage in a myriad of computer vision tasks or
applications like semantic segmentation [61], object detection [65], and
autonomous driving [1]. Recently, generated data from large-scale pre-trained
diffusion models was used to train better object classification models [4].
Particularly, [67, 35] showed that synthetic data is extremely useful in
transfer learning, zero-shot, and few-shot classification. [31, 74, 22] show
that even training of large-scale self-supervised models, such as CLIP [60]
and SimCLR [14], is possible with synthetic data. Our work focuses on such
synthetic clone models where the training data was generated using large-scale
pre-trained diffusion models. We use diffusion models because of the superior
quality and diversity of the generated data.

Robustness. An often overlooked aspect when evaluating models trained with
synthetic datasets is evaluating them for robustness. Recently, some efforts
have been made to benchmark models trained with synthetic data for adversarial
robustness [69] and out-of-distribution (OOD) detection [6]. Still, no
comprehensive robustness evaluation of these models exists. In our work, we
aim to benchmark synthetic clone models in a more comprehensive manner and on
various robustness benchmarks. Besides adversarial robustness [28] and OOD
detection, we also benchmark these models on common 2D and 3D image
corruptions [44, 36], and w.r.t. shape bias [25], context bias [46],
background bias [52], and calibration [30]. Previous works [6, 69] have only
benchmarked small-scale supervised synthetic models, while we analyze
synthetic clones trained with 100s of millions of synthetic images across
three classes of models, namely supervised, self-supervised, and multi-modal
ones.

##  3 Background: Synthetic Clones

Before analyzing various synthetic clone models below, let us briefly
recapitulate how synthetic images can be generated using diffusion models and
how various classes of models have been trained on these synthetic images.

Figure 2: Setups for training different classes of models using synthetic
images. Supervised learning _(bottom)_ uses the ground-truth label for
conditionally generating a synthetic image, while self-supervised _(top left)_
and multi-modal methods _(top right)_ make use of a concept bank along with a
large language model (LLM) for prompt generation. Please see text for more
details.

Synthetic data generation. The synthetic images in synthetic clone models [22,
31, 73, 67] are typically generated using large-scale pre-trained image
generation models, _e.g_., Stable Diffusion [64] or Imagen [66]. The input to
the generation model is Gaussian noise and a conditional text prompt.
Synthetic clones can be divided into three categories, namely supervised
synthetic models, self-supervised synthetic models, and multi-modal synthetic
models. We now describe how each model creates the prompt for generating the
image and which losses are used to train the model.

Supervised models using generated data. For training a supervised classifier,
Sarıyıldız et al. [67] first generate an image using Stable Diffusion
conditioned on the prompt “c, $\text{h}_{\text{c}}$ inside b”. Here, c is the
ground-truth class name sampled from all class labels of a dataset (_e.g_.,
ImageNet-1K [15]), $\text{h}_{\text{c}}$ is the hypernym associated with c,
and b denotes one of the 365 classes from the Places365 [88] dataset. A
hypernym of c is the parent node of c in the WordNet [23] hierarchy. The
classifier is then trained end to end with the cross-entropy loss
($\mathcal{L}_{\text{CE}}$) between the predicted label of the generated image
and the sampled ground-truth class label used for generating the image; see
Fig. 2 (_bottom_). Sarıyıldız et al. [67] created 1.2M such prompts and
generated corresponding images to train a ResNet50 model. Similarly, Fan et
al. [22] used just class names “c” for generating 16M images. They then train
a ViT-B model on the generated images and ground-truth class labels.

Self-supervised models using generated data. Synthetic self-supervised models,
namely _Syn_ CLR [73] and StableRep [74], first sample a concept label from a
concept bank. The concept bank is typically constructed using extracted
synsets of WordNet [23] or common unigrams, bigrams, and titles from Wikipedia
[85]. This sampled concept label is then fed into a large language model (LLM)
[76, 2, 42] for generating extra contextual information. The final prompt is
formed by concatenating the concept label and the contextual information. This
prompt is then used to generate $n$ images. After this, several augmentations
(Aug.) also used in the SimCLR model [14] are applied. The _Syn_ CLR model is
trained using a multi-positive contrastive loss
($\mathcal{L}_{\text{Contra}}$) [73, 47], see in Fig. 2 (_upper left_).

Multi-modal model using generated data. The multi-modal synthetic CLIP [22,
31] models also use a concept label sampled from a concept bank. This concept
label, along with a random place label sampled from the classes of Places365
dataset, is fed into an LLM [2] for generating a caption, which is
subsequently used for conditional image generation. These images are used to
train a CLIP model [60] using a contrastive loss between the generated image
and the prompt that was used for generating the image. The architecture is
shown in Fig. 2 (_upper right_).

##  4 Robustness Analysis

#### Setup.

We divide the models to be analyzed into supervised, self-supervised, and
multi-modal models. For synthetic supervised models, we use a ResNet50 from
[67] and a ViT-B model from [22], which were trained on approx. 1M images
generated using prompts as described in Sec. 3. The class labels used for
creating the prompts were sampled from the classes of the ImageNet-1K dataset
[15]. For clarity of notation, we term them _Syn_ ResNet50 and _Syn_ ViT-B for
all our experiments. We compare these models against strong supervised models
trained on the real ImageNet-1K dataset like ResNet50 [32], ViT-B [20], DeiT-
III [75], Swin transformer [50], and ConvNeXt [51]. All baselines are from the
PyTorch Image Models library [80].

Figure 3: Test error _vs_. ECE for ID and OOD datasets. We report the resulting ECE metric and test error metrics for both ID (ImageNet) and OOD datasets (ImagNet-{R,A}). Filled markers indicate real models, empty markers indicate synthetic clones. Table 1: OOD detection with ImageNet-1K being in-domain (ID). We report the AUROC and FPR@95 metrics for the OOD detection task on the three OOD datasets, namely SUN, iNatualist, and Places. In addition, we also report the avg. performance of all models on all three datasets. The best performing model in each category is highlighted in bold. | No. of training images |  SUN |  iNaturalist |  Places | Avg.
---|---|---|---|---|---
Model |  AUROC $(\uparrow)$ |  FPR@95 $(\downarrow)$ |  AUROC $(\uparrow)$ |  FPR@95 $(\downarrow)$ |  AUROC $(\uparrow)$ |  FPR@95 $(\downarrow)$ |  AUROC $(\uparrow)$ |  FPR@95 $(\downarrow)$
ResNet50 | 1.2M | 0.84 | 0.65 | 0.91 | 0.47 | 0.82 | 0.69 | 0.86 | 0.60
_Syn_ ResNet50 | 1.2M | 0.70 | 0.83 | 0.72 | 0.89 | 0.67 | 0.87 | 0.70 | 0.86
Swin-B | 1.2M | 0.79 | 0.63 | 0.86 | 0.45 | 0.77 | 0.69 | 0.81 | 0.59
ConvNeXt | 1.2M | 0.76 | 0.68 | 0.89 | 0.45 | 0.74 | 0.71 | 0.80 | 0.61
DeiT | 1.2M | 0.80 | 0.66 | 0.89 | 0.48 | 0.80 | 0.68 | 0.83 | 0.61
ViT-B | 1.2M | 0.81 | 0.64 | 0.90 | 0.45 | 0.80 | 0.67 | 0.84 | 0.59
_Syn_ ViT-B | 16M | 0.76 | 0.74 | 0.75 | 0.75 | 0.72 | 0.79 | 0.74 | 0.76
MAE | 1.2M | 0.76 | 0.84 | 0.87 | 0.71 | 0.75 | 0.86 | 0.79 | 0.80
DINOv2 | 142M | 0.88 | 0.49 | 0.98 | 0.09 | 0.87 | 0.53 | 0.91 | 0.37
MOCOv3 | 1.2M | 0.84 | 0.65 | 0.94 | 0.35 | 0.84 | 0.66 | 0.87 | 0.55
_Syn_ CLR | 600M | 0.85 | 0.58 | 0.95 | 0.24 | 0.83 | 0.63 | 0.88 | 0.48
CLIP | 400M | 0.82 | 0.74 | 0.68 | 0.88 | 0.78 | 0.76 | 0.76 | 0.79
_Syn_ CLIP | 371M | 0.73 | 0.75 | 0.74 | 0.75 | 0.70 | 0.79 | 0.72 | 0.76

For the self-supervised case, we use the _Syn_ CLR model [73], which has been
trained on 600M synthetic images. We use SOTA self-supervised models like
DINOv2 [57], MAE [34], and MOCOv3 [33] trained on ImageNet-1K as self-
supervised baselines. All checkpoints for the baseline models were obtained
from the timm library. For a fair comparison, we use the ViT-B [20] backbone
with a patch size of 16 for all models. We perform linear probing on all self-
supervised models, training a single-layer linear classification head on the
top of these models for 90 epochs using the ImageNet-1k [15] dataset. We
searched over ten learning rates to find the optimal linear classifier for
each model.

Finally, for the multi-modal case, we analyze the synthetic CLIP model from
[22], which we term as _Syn_ CLIP, trained on 371M synthetic images. We
compare this model with the CLIP implementation from OpenCLIP [41], trained on
400M real images. We used the ViT-B backbone for these models to allow for a
fair comparison. For CLIP and _Syn_ CLIP we report the zero-shot results.

###  4.1 Calibration

As neural networks become adopted for safety-critical tasks like autonomous
driving and healthcare, it is not only important to predict accurate results,
but also to accurately report the confidence in their prediction [30].
Calibration can help to understand how reliable the model’s prediction is and
whether an end user can trust the model’s output. The calibration of neural
networks is commonly measured using the Expected Calibration Error (ECE) [55].
The ECE measures the expected absolute difference between the model confidence
and the model accuracy. In our work, we study the effect that training on
synthetic images has on the calibration of a model compared to training with
real data.

We report the results for the ECE metric with $20$ bins for all models. Fig. 3
shows the results for both in-distribution (ID) calibration (train and test
splits are from the same dataset) on the ImageNet-1k dataset [15] and for out-
of-distribution (OOD) calibration (train and test split are from different
datasets) on the ImageNet-R [37] and ImageNet-A [38] datasets. We can conclude
the following:

Observation 1: _Synthetic clones are mostly well calibrated for the in-
distribution case and even to some extent out-of-distribution on ImageNet-R.
The OOD calibration of synthetic clones suffers on ImageNet-A._

This may be because the synthetic data generated from pre-trained diffusion
models (trained on data scraped from the web) already captures the
distribution of the ImageNet (images scraped from the web) and ImageNet-R
(consisting of cartoons and sketches, which are abundant on the internet)
datasets. ImageNet-A, on the other hand, consists of naturally adversarial
examples that are hard to find on the internet; hence, synthetic clones and
even baseline models trained on real images exhibit a rather poor calibration
for this dataset. However, models trained with real datasets are generally
better calibrated for ImageNet-A, likely due to the inherent noise in the
dataset (see also Sec. 4.2).

#### Out of distribution (OOD) detection

deals with finding out how well a model can distinguish between samples from
the training data distribution (ID – in distribution) and samples from another
distribution. OOD detection is critical to increasing an end users’ trust in
the safety and reliability of the model. We thus aim to evaluate how training
on synthetic data affects a model’s capability for OOD detection.

The OOD detection task can be formulated as a binary classification task on
the model’s predictive probability. A model $F$ with weights $\theta$
classifies an input sample $x_{i}$ as ID if the maximum predictive probability
of the sample is higher than a pre-defined threshold value $\tau$, _i.e_.
$\max F_{\theta}(x_{i})\geq\tau$, and as OOD if $\max F_{\theta}(x_{i})<\tau$.
OOD detection can be evaluated using standard metrics for binary
classification, such as the area under the receiver operating characteristic
curve (AUROC). We also report the false positive rate of OOD samples when the
true positive rate of in-distribution samples is at 95% (FPR@95). Tab. 1 shows
the results of all models on three OOD datasets, namely SUN397 [81], Places365
[88], and iNaturalist [78], where ImageNet-1K is the ID dataset. We conclude
the following:  Observation 2: __Syn_ CLR and _Syn_ CLIP are comparable to the
baseline models in their category for OOD detection. Even with 16 times more
data than the baseline, _Syn_ ViT-B clearly lags behind supervised models
trained with real data._

###  4.2 Robustness

#### Adversarial robustness.

Adversarial learning aims to understand model robustness to examples
manipulated by an adversary in a way that the examples seem similar to the
human eye but change the model’s predictions. In our work, we want to explore
whether models trained on synthetic data are more susceptible to adversarial
attacks. We use two popular white-box attacks, the Fast Gradient Sign Method
(FGSM) [28] and the Projected Gradient Descent (PGD) attack [52]. These white-
box attacks require that the model’s gradient be known to the adversary. The
FGSM attack perturbs the input image with the gradient of the model’s
prediction w.r.t. its input, scaled by a small step $\epsilon$. This can be
written as $\hat{x}_{i}=x_{i}+\epsilon\nabla_{x_{i}}J(\theta,x_{i},y_{i}),$
where $x_{i}$ denotes the input image, $\nabla_{x_{i}}J$ denotes the gradient
of the loss function w.r.t. $x_{i}$, and $y_{i}$ denotes the label for the
input image $x_{i}$. The PGD attack is an iterative version of the FGSM
attack, followed by a projection of the adversarial input to an $\epsilon$
ball around the input $x$. The $\epsilon$ value denotes the maximum
perturbation allowed. We use $\epsilon$ values of 1/255 for the PGD and FGSM
attacks. The number of steps is set to 20 for the PGD attack. We report the
accuracy of the clean and the adversarial examples from the test set. We
define the adversarial robustness metric, $R_{\text{adv}}$, as the relative
accuracy between adversarial and clean samples as
$R_{\text{adv}}=\frac{\text{Acc}_{\text{adv}}}{\text{Acc}_{\text{clean}}},$
where $\text{Acc}_{\text{adv}}$ is the accuracy on the adversarial samples and
the $\text{Acc}_{\text{clean}}$ is the accuracy on the clean samples. Tab. 2
shows the results. We can conclude the following:

Table 2: Adversarial robustness results (in %). We report the clean and adversarial accuracy. Also, we report the relative adversarial robustness ($R_{\text{adv}}$) metric for each model.  |  | FGSM | PGD
---|---|---|---
Model |  $\text{Acc}_{\text{clean}}(\uparrow)$ |  $\text{Acc}_{\text{adv}}(\uparrow$) |  $R_{\text{adv}}(\uparrow)$ |  $\text{Acc}_{\text{adv}}(\uparrow)$ |  $R_{\text{adv}}(\uparrow)$
ResNet50 |  80.12 |  26.95 |  33.64 |  16.71 |  20.85
_Syn_ ResNet50 |  42.89 |  2.12 |  4.95 |  1.27 |  2.96
Swin-B |  83.08 |  48.59 |  58.49 |  23.71 |  28.54
ConvNext |  85.52 |  42.19 |  49.33 |  17.51 |  20.47
DeiT |  84.59 |  53.22 |  62.92 |  35.51 |  41.98
ViT-B |  76.78 |  27.39 |  35.67 |  20.45 |  26.64
_Syn_ ViT-B |  50.96 |  8.84 |  17.35 |  5.06 |  9.92
MAE |  67.59 |  0.67 |  0.99 |  1.34 |  1.98
DINOv2 |  84.49 |  19.10 |  22.61 |  18.71 |  22.14
MOCOv3 |  76.66 |  13.21 |  17.23 |  9.11 |  11.88
_Syn_ CLR |  80.46 |  7.31 |  9.08 |  6.18 |  7.68
CLIP |  68.27 |  8.75 |  12.82 |  6.31 |  9.24
_Syn_ CLIP |  55.11 |  2.40 |  4.35 |  2.02 |  3.67

Observation 3: _Synthetic clone models are significantly more vulnerable to
adversarial examples, particularly supervised synthetic clones, than models
trained with real data. The self-supervised synthetic clone model trained with
large amounts of synthetic data,_i.e_. _Syn_ CLR, is loosely comparable to
real-image baseline models in its respective category._

We find that MAE [34] performs the worst among all models (synthetic and real)
regarding adversarial robustness, indicating that the training objective along
with the training dataset size are important factors in determining a model’s
adversarial robustness.

Table 3: Common corruptions robustness results (in %). We report the individual and average accuracy for various 2D and 3D common corruptions. We also report the relative average accuracy (Avg. $R_{cc}$) for all models. Noise | ResNet50 |  _Syn_ ResNet50 | Swin-B | ConvNeXt | DeiT | ViT-B |  _Syn_ ViT-B | MAE | DINOv2 | MOCOv3 |  _Syn_ CLR | CLIP |  _Syn_ CLIP
---|---|---|---|---|---|---|---|---|---|---|---|---|---
$\text{Acc}_{\text{Clean}}$ | 80.12 | 42.89 | 83.08 | 85.52 | 84.59 | 76.78 | 50.96 | 67.59 | 84.49 | 76.66 | 80.46 | 68.27 | 55.11
Shot noise | 56.31 | 5.11 | 66.33 | 72.31 | 75.41 | 57.95 | 29.03 | 34.47 | 73.45 | 57.14 | 43.23 | 44.13 | 19.85
Motion blur | 47.55 | 5.56 | 59.87 | 67.30 | 70.85 | 49.58 | 19.91 | 27.70 | 67.24 | 48.68 | 37.47 | 38.63 | 16.67
Snow | 44.32 | 7.07 | 57.62 | 65.38 | 69.02 | 45.71 | 18.33 | 25.87 | 67.17 | 46.27 | 40.38 | 38.22 | 16.64
Pixelate | 45.32 | 7.38 | 58.11 | 66.07 | 69.66 | 46.95 | 19.96 | 27.89 | 69.06 | 48.47 | 41.33 | 40.14 | 17.26
JPEG compression | 47.03 | 7.09 | 58.92 | 67.51 | 70.37 | 49.82 | 20.91 | 30.38 | 70.70 | 51.60 | 39.66 | 41.81 | 16.34
Near focus | 64.55 | 27.28 | 69.11 | 75.23 | 75.82 | 63.17 | 33.98 | 47.18 | 77.33 | 65.14 | 67.57 | 56.90 | 34.64
Far focus | 60.94 | 24.76 | 65.93 | 72.53 | 73.28 | 60.13 | 31.34 | 43.96 | 75.35 | 61.77 | 63.85 | 53.89 | 32.04
Fog 3D | 58.80 | 23.22 | 63.67 | 70.17 | 71.00 | 58.11 | 30.57 | 40.17 | 72.87 | 58.64 | 60.48 | 51.29 | 30.88
XY motion blur | 54.30 | 19.42 | 60.12 | 66.86 | 67.94 | 53.95 | 26.71 | 35.25 | 69.11 | 54.43 | 54.78 | 47.20 | 27.05
Z motion blur | 50.43 | 16.77 | 56.85 | 64.28 | 65.52 | 50.12 | 22.97 | 32.07 | 66.59 | 50.65 | 50.10 | 43.90 | 23.64
Avg. $\text{Acc}_{\text{cc}}$ ($\uparrow$) | 52.96 | 14.37 | 61.65 | 68.76 | 70.89 | 53.55 | 25.37 | 34.50 | 70.89 | 54.28 | 49.88 | 45.61 | 23.50
Avg. $R_{\text{cc}}(\uparrow)$ | 66.10 | 33.50 | 74.21 | 80.40 | 83.80 | 69.74 | 49.78 | 51.04 | 83.90 | 70.81 | 61.99 | 66.81 | 42.64

Robustness against common corruptions. Next, we evaluate the performance of
all models on real-world noise corruptions that occur frequently. For this, we
evaluate on the ImageNet-C [36] and ImageNet-3DCC [44] datasets. ImageNet-C
consists of 19 naturally occurring image corruptions like Gaussian noise, shot
noise, motion blur, elastic transforms, _etc_. ImageNet-3DCC includes 12
common corruptions that take depth into account, _e.g_., $z$-axis blur, far
and near focus errors, _etc_. Due to time and resource constraints, we report
the results only on ten common corruption tasks (five each from ImageNet-C and
ImageNet-3DCC). We report the accuracy of the clean and corrupted samples and
the average accuracy over all corruptions. We also report the Avg.
$R_{\text{cc}}$ metric, which is defined as the relative accuracy between the
clean samples and the average accuracy over all corruptions, _i.e_. Avg.
$R_{\text{cc}}=\frac{\text{Avg. Acc}_{\text{cc}}}{\text{Acc}_{\text{clean}}}$.
The results are given in Tab. 3 and yield the following conclusion:

Observation 4: _Synthetic clones are significantly less robust to common
corruptions in images than baselines trained with real images._

The Avg. $R_{\text{cc}}$ is significantly lower for synthetic clones across
all categories of models. Real datasets inherently have these common
corruptions present in the imagery, hence training on real data already makes
the resulting models more robust to noise. Synthetic images currently lack
these corruptions, making synthetic clones highly susceptible to common image
corruptions.

###  4.3 Biases

#### Context bias.

We define context bias as the affinity of a model to use contextual cues,
_e.g_., location for classifying objects, rather than actually using the
object appearance. This context bias exists because most large-scale datasets
consist of uncurated data scraped from the internet. For example, images of
airplanes in a forest are highly unlikely when compared to airplanes on a
taxiway. We use the FOCUS (Familiar Objects in Common and Uncommon Settings)
dataset [46] to evaluate the context bias, which consists of around 21K
images. Each image in the dataset is annotated with the object class, the time
of day, location, and weather labels. FOCUS subdivides the dataset into a
subset of common and uncommon samples. Uncommon samples are uncommon in the
real world, like “airplane in forest” or uncommon in the ImageNet dataset due
to labels used for its construction (_e.g_., there is no label for seaplane in
ImageNet). The dataset is partitioned into mutually exclusive partitions
$P_{k}$ where $k$ is the number of uncommon attributes. The total dataset is
divided into four partitions, $P_{0}$ (containing only common objects) to
$P_{3}$ (containing three uncommon attributes). We report the $\text{CB}_{k}$
metrics (Context Bias with $k$ uncommon attributes), which is defined as the
relative accuracy between the accuracy on the partition with no uncommon
attributes $P_{0}$ and a partition with $k$ uncommon attributes $P_{k}$,
_i.e_. $\text{CB}_{k}=\frac{\text{Acc}_{P_{k}}}{\text{Acc}_{P_{0}}}$. For
example, $\text{CB}_{2}$ measures the relative accuracy between $P_{0}$ and
$P_{2}$. The results are given in Tab. 4 and yield the following:

Table 4: Context bias results (in %). $\text{CB}_{k}$ denotes the context bias with $k$ uncommon attributes. Model |  $\text{CB}_{1}$ ($\uparrow$) |  $\text{CB}_{2}$ ($\uparrow$)
---|---|---
ResNet50 |  61.27 |  38.70
_Syn_ ResNet50 |  62.33 |  44.49
Swin-B |  68.83 |  54.85
ConvNext |  70.20 |  55.57
DeiT |  68.19 |  55.19
ViT-B |  67.21 |  49.71
_Syn_ ViT-B |  66.13 |  50.29
MAE |  59.75 |  46.53
DINOv2 |  69.11 |  54.46
MOCOv3 |  62.29 |  44.95
_Syn_ CLR |  70.04 |  58.42
CLIP |  76.77 |  63.09
_Syn_ CLIP |  71.47 |  54.39

Observation 5: _Self-supervised synthetic clones are robust to changes in
context compared to baseline supervised and self-supervised models trained
with real data. The supervised synthetic clone _Syn_ ViT-B is comparable in
performance to the ViT-B model trained on real data. Meanwhile, _Syn_ CLIP is
more prone to changes in context compared to CLIP, but it is still comparable
to models like DINOv2 and ConvNeXt._

Shape-texture bias. Children learn to recognize and organize objects based on
shape and are more biased towards object shape rather than color and textures
[16, 71]. It has been shown [25, 54] that biasing a network towards shape
increases its robustness against common corruptions. This suggests that the
robustness of neural networks generally benefits from biasing towards
categorizing objects by shape rather than textures. Generated images from GANs
typically have high-frequency artifacts (indicating high texture bias) [68,
21]. Diffusion models also exhibit similar patterns, though these are more
muted [62]. Such artifacts contrast with real images that do not contain these
high-frequency artifacts. To understand if training on synthetic images from
Stable Diffusion biases the networks towards texture, we use the cue conflict
dataset [25]. This dataset consists of about 1200 images of 16 classes where
the texture and shape of an image are in conflict with each other.

Total shape bias | Class-wise shape bias
---|---
|
Figure 4: Shape bias. _(left)_ Average shape bias of models trained with
synthetic (dashed bars) and real data. Synthetic clones are generally more
biased toward shape than texture compared to models trained with real
datasets. _(right)_ Class-wise shape bias of synthetic clones and their
counterparts trained using real data. Solid and dashed lines represent the
mean shape bias of models trained with real images and synthetic images,
respectively.

Fig. 4 shows the shape bias of all the models averaged across all classes. We
also show the class-wise shape bias results for synthetic clones and some
baseline models. We conclude the following:

Observation 6: _Synthetic clones tend to be more shape-biased than texture-
biased._ In particular, _Syn_ CLIP outperforms all models on the shape bias
metric, while _Syn_ ViT-B outperforms all classification and self-supervised
models. The _Syn_ CLR model has comparable performance to the MOCOv3 model and
outperforms the MAE model on the shape-bias metric.

A similar result was observed in [8] with synthetic data from StyleGANv2 [45]
models. Our results indicate that synthetic data is diverse in terms of shape,
leading to a higher shape bias of synthetic clone models, but this could
indicate that the generated images lack texture diversity, making the network
rely more on shape for classification.

Table 5: Background bias results (in %). BG-Gap metric reports the drop in performance by just changing the background to a different class than the foreground class. Model |  Original Acc. (IN-9L, $\uparrow$) |  Mix-Same Acc. $(\uparrow)$ |  Mix-Rand Acc. $(\uparrow)$ |  BG-Gap $(\downarrow)$
---|---|---|---|---
ResNet50 |  95.43 |  87.04 |  81.36 |  5.68
_Syn_ ResNet50 |  66.44 |  44.35 |  35.83 |  8.52
Swin-B |  96.57 |  88.32 |  82.57 |  5.75
ConvNeXt |  97.98 |  93.95 |  90.40 |  3.56
DeiT |  97.70 |  93.28 |  89.98 |  3.31
ViT-B |  95.98 |  87.53 |  79.63 |  7.90
_Syn_ ViT-B |  87.70 |  77.01 |  71.60 |  5.41
MAE |  57.36 |  46.47 |  40.57 |  5.90
DINOv2 |  97.95 |  91.93 |  85.95 |  5.98
MOCOv3 |  95.01 |  83.63 |  74.17 |  9.46
_Syn_ CLR |  96.22 |  86.59 |  80.37 |  6.22
CLIP |  93.31 |  83.09 |  77.19 |  5.90
_Syn_ CLIP |  84.79 |  71.16 |  65.83 |  5.33
Table 6: Effect of prompt type and dataset size on various performance metrics for the supervised _Syn_ ViT-B model. $R_{\text{adv}}$ (FGSM) denotes the adversarial robustness for the FGSM attack, and $R_{\text{cc}}$ (2DCC) the robustness for 2D common corruptions. Bold indicates the best performance within a prompt type, and color indicates the best performance across all prompts and dataset sizes. Metric | Class name | Captions | CLIP templates
---|---|---|---
|  1M |  4M |  8M |  16M |  1M |  4M |  8M |  16M |  1M |  4M |  8M |  16M
Acc. $(\uparrow)$ |  0.44 |  0.49 |  0.50 |  0.51 |  0.50 |  0.58 |  0.59 |  0.60 |  0.45 |  0.53 |  0.54 |  0.55
$R_{\text{adv}}$ (FGSM, $\uparrow)$ |  0.14 |  0.18 |  0.17 |  0.17 |  0.12 |  0.16 |  0.16 |  0.17 |  0.15 |  0.17 |  0.18 |  0.18
$R_{\text{cc}}$ (2D-CC, $\uparrow)$ |  0.39 |  0.42 |  0.43 |  0.42 |  0.37 |  0.43 |  0.44 |  0.44 |  0.44 |  0.51 |  0.54 |  0.54
$\text{CB}_{2}$$(\uparrow)$ |  0.47 |  0.47 |  0.47 |  0.50 |  0.52 |  0.58 |  0.58 |  0.59 |  0.47 |  0.53 |  0.50 |  0.50
Shape Bias $(\uparrow)$ |  0.39 |  0.55 |  0.56 |  0.56 |  0.33 |  0.42 |  0.47 |  0.45 |  0.57 |  0.71 |  0.71 |  0.69
BG-Gap $(\downarrow)$ |  0.71 |  0.66 |  0.61 |  0.54 |  0.85 |  0.54 |  0.53 |  0.52 |  0.63 |  0.42 |  0.37 |  0.46
FPR@95 (SUN, $\downarrow)$ |  0.81 |  0.74 |  0.75 |  0.74 |  0.77 |  0.74 |  0.73 |  0.74 |  0.84 |  0.82 |  0.81 |  0.80
ECE $(\downarrow)$ |  0.33 |  0.31 |  0.29 |  0.28 |  0.25 |  0.18 |  0.17 |  0.16 |  0.30 |  0.24 |  0.23 |  0.23
Table 7: Effect of dataset composition and size on various performance metrics for the _Syn_ CLIP model. Bold indicates the best performance within a prompt type, and color indicates the best performance across all dataset compositions and sizes. Metric | Real | Synthetic | Synthetic + Real
---|---|---|---
|  64M |  128M |  256M |  371M |  64M |  128M |  256M |  371M |  64M |  128M |  256M |  371M
Acc. $(\uparrow)$ |  0.55 |  0.60 |  0.65 |  0.66 |  0.47 |  0.51 |  0.54 |  0.55 |  0.56 |  0.62 |  0.65 |  0.66
$R_{\text{adv}}$ (FGSM, $\uparrow)$ |  0.09 |  0.07 |  0.10 |  0.12 |  0.05 |  0.03 |  0.04 |  0.04 |  0.09 |  0.08 |  0.10 |  0.12
$R_{\text{cc}}$ (2D-CC, $\uparrow)$ |  0.44 |  0.46 |  0.51 |  0.52 |  0.29 |  0.28 |  0.31 |  0.31 |  0.46 |  0.48 |  0.52 |  0.52
$\text{CB}_{2}$ $(\uparrow)$ |  0.52 |  0.52 |  0.57 |  0.61 |  0.58 |  0.53 |  0.55 |  0.54 |  0.61 |  0.58 |  0.63 |  0.61
Shape Bias $(\uparrow)$ |  0.51 |  0.51 |  0.51 |  0.52 |  0.54 |  0.55 |  0.59 |  0.58 |  0.54 |  0.51 |  0.56 |  0.60
BG-Gap $(\downarrow)$ |  0.73 |  0.76 |  0.57 |  0.72 |  0.65 |  0.51 |  0.57 |  0.53 |  0.73 |  0.63 |  0.63 |  0.56
FPR@95 (SUN, $\downarrow)$ |  0.92 |  0.84 |  0.81 |  0.82 |  0.86 |  0.75 |  0.75 |  0.75 |  0.86 |  0.81 |  0.82 |  0.78
ECE $(\downarrow)$ |  0.22 |  0.19 |  0.16 |  0.14 |  0.25 |  0.20 |  0.17 |  0.16 |  0.16 |  0.13 |  0.11 |  0.11

Background bias. The background bias of models can be used to identify if the
model is using the background of the image to make the classification decision
instead of using the object itself. Learning if a model is biased towards the
background is an effective way to understand if the model has learned
shortcuts [26] instead of learning good features for the given category. For
evaluating a model’s background bias, we utilize the Mixed-Rand and Mixed-Same
partitions from the IN-9L dataset [82]. The Mixed-Rand dataset segments the
foreground object in an image and switches the original background with a
random background from a different class label, while the Mixed-Same partition
places the segmented foreground object on a random background from the same
class label. Tab. 5 shows the accuracy of all models on the original, Mixed-
Rand, and Mixed-Same partitions from the IN-9L dataset, along with BG-Gap. The
BG-Gap measures the difference in performance between accuracies on the Mixed-
Rand and Mixed-Same datasets and assesses how decisions can be manipulated
just by changing the background to a different class than the foreground. We
conclude the following:

Observation 7: _Synthetic clones perform on par in terms of background bias
with a SOTA baseline model trained with real data._

In general, we found all models (synthetic and real) to be very robust to
background changes.

###  4.4 Ablations

We now look at three important factors that affect the robustness of synthetic
clone models. We use the models from [22] for these ablations (including all
the CLIP models).

Effect of prompts. Here, we analyze the effect that the prompt has on the
robustness of the synthetic clone models. Tab. 6 shows results for a _Syn_
ViT-B model [22] trained on synthetic images generated using different prompts
such as _(i)_ class names, _(ii)_ 80 CLIP templates, _e.g_. “high-quality
photo of {class name}”, used in evaluating the zero-shot classification
performance of the CLIP model, and _(iii)_ class names combined with a
generated caption from BLIP2 [49], _e.g_. “Tench [class label], a man holding
a fish”. As can be seen in Tab. 6, captions and CLIP templates are much better
for creating robust synthetic clones compared to just using class names. This
can be attributed to more diverse images being generated with more descriptive
text.

Effect of adding real data. Next, we study the effect of using a mixture of
real and synthetic image data on the robustness of the CLIP model. Fan et al.
[22] trained the CLIP model with a fixed dataset size (for example, 371M
images) where the real and synthetic images are picked randomly to create a
subset containing both real and synthetic images, which are then used for
training the CLIP model. Tab. 7 shows that adding real data as suggested by
[22] improves the performance on many key metrics (ECE, adversarial accuracy,
shape bias) while remaining comparable on others. Also, we see that training
with just synthetic images or a combination of synthetic and real images
creates more robust models compared to models trained just on real data.

Size of generated data. We evaluate the effect of dataset size on the training
of synthetic clones. As seen in Tabs. 7 and 6, adding more data, in general,
helps with the robustness of both _Syn_ ViT-B and _Syn_ CLIP models. In some
cases, adding more data may slightly decrease performance, which can be due to
less dataset diversity with increasing dataset size and overfitting of the
model with less diverse data.

##  5 Conclusion

Our work is the first to perform a detailed analysis of models trained with
synthetic data across different robustness measures. Specifically, we show
that certain synthetic clones, namely _Syn_ CLIP and _Syn_ CLR, perform within
tolerable limits of their counterparts trained on real images; this holds for
all robustness metrics except for common corruptions and OOD detection.
Supervised models, namely _Syn_ ViT-B, on the other hand, are outperformed by
their real-image counterparts on all metrics except shape bias, which clearly
shows the need for better supervised synthetic clones. Through detailed
ablations, we find that using captions or CLIP templates produces more robust
synthetic clones. Importantly, we find that mixing real data with synthetic
data can improve the robustness measures across most metrics. We hope our work
encourages the development of more robust synthetic clones.

#### Acknowledgements.

This project has received funding from the European Research Council (ERC)
under the European Union’s Horizon 2020 program (grant agreement No. 866008).
The project was also supported in part by the State of Hesse through the
project “The Third Wave of Artificial Intelligence (3AI)”.

## References

  * Abu Alhaija et al. [2018] Hassan Abu Alhaija, Siva Karthik Mustikovela, Lars Mescheder, Andreas Geiger, and Carsten Rother.  Augmented reality meets computer vision: Efficient data generation for urban driving scenes.  _IJCV_ , pages 961–972, 2018.
  * Achiam et al. [2023] Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al.  GPT-4 technical report.  _arXiv:2303.08774 [cs.CL]_ , 2023.
  * Arjovsky et al. [2017] Martin Arjovsky, Soumith Chintala, and Léon Bottou.  Wasserstein generative adversarial networks.  In _ICML_ , pages 214–223, 2017.
  * Azizi et al. [2023] Shekoofeh Azizi, Simon Kornblith, Chitwan Saharia, Mohammad Norouzi, and David J. Fleet.  Synthetic data from diffusion models improves ImageNet classification.  _TMLR_ , 2023.
  * Bahri et al. [2021] Yasaman Bahri, Ethan Dyer, Jared Kaplan, Jaehoon Lee, and Utkarsh Sharma.  Explaining scaling laws of neural network generalization.  _arXiv:2102.06701 [cs.LG]_ , 2021.
  * Bansal and Grover [2023] Hritik Bansal and Aditya Grover.  Leaving reality to imagination: Robust classification via generated datasets.  _arXiv:2302.02503 [cs.CV]_ , 2023.
  * Bao et al. [2022] Hangbo Bao, Li Dong, Songhao Piao, and Furu Wei.  BEiT: Bert pre-training of image transformers.  In _ICLR_ , 2022.
  * Benarous et al. [2023] Elior Benarous, Sotiris Anagnostidis, Luca Biggio, and Thomas Hofmann.  Harnessing synthetic datasets: The role of shape bias in deep neural network generalization.  _arXiv:2311.06224 [cs.CV]_ , 2023.
  * Biswas et al. [2023] Md Rafiul Biswas, Ashhadul Islam, Zubair Shah, Wajdi Zaghouani, and Samir Brahim Belhaouari.  Can ChatGPT be your personal medical assistant?  In _SNAMS_ , pages 1–5, 2023.
  * Brock et al. [2019] Andrew Brock, Jeff Donahue, and Karen Simonyan.  Large scale GAN training for high fidelity natural image synthesis.  In _ICLR_ , 2019.
  * Caron et al. [2020] Mathilde Caron, Ishan Misra, Julien Mairal, Priya Goyal, Piotr Bojanowski, and Armand Joulin.  Unsupervised learning of visual features by contrasting cluster assignments.  _NeurIPS_ , pages 9912–9924, 2020.
  * Caron et al. [2021] Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin.  Emerging properties in self-supervised vision transformers.  In _ICCV_ , pages 9650–9660, 2021.
  * Chen et al. [2018] Ricky T. Q. Chen, Yulia Rubanova, Jesse Bettencourt, and David K. Duvenaud.  Neural ordinary differential equations.  _NeurIPS_ , pages 6572–6583, 2018.
  * Chen et al. [2020] Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton.  A simple framework for contrastive learning of visual representations.  In _ICML_ , pages 1597–1607, 2020.
  * Deng et al. [2009] Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei.  ImageNet: A large-scale hierarchical image database.  In _CVPR_ , pages 248–255, 2009.
  * Diesendruck and Bloom [2003] Gil Diesendruck and Paul Bloom.  How specific is the shape bias?  _Child development_ , pages 168–178, 2003.
  * Dinh et al. [2016] Laurent Dinh, Jascha Sohl-Dickstein, and Samy Bengio.  Density estimation using Real NVP.  In _ICLR_ , 2016.
  * Doersch et al. [2015] Carl Doersch, Abhinav Gupta, and Alexei A Efros.  Unsupervised visual representation learning by context prediction.  In _ICCV_ , pages 1422–1430, 2015.
  * Dohmatob et al. [2024] Elvis Dohmatob, Yunzhen Feng, Pu Yang, Francois Charton, and Julia Kempe.  A tale of tails: Model collapse as a change of scaling laws.  _arXiv:2402.07043 [cs.LG]_ , 2024.
  * Dosovitskiy et al. [2020] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al.  An image is worth 16x16 words: Transformers for image recognition at scale.  In _ICLR_ , 2020.
  * Durall et al. [2020] Ricard Durall, Margret Keuper, and Janis Keuper.  Watch your up-convolution: CNN based generative deep neural networks are failing to reproduce spectral distributions.  In _CVPR_ , pages 7890–7899, 2020.
  * Fan et al. [2023] Lijie Fan, Kaifeng Chen, Dilip Krishnan, Dina Katabi, Phillip Isola, and Yonglong Tian.  Scaling laws of synthetic images for model training …for now.  _arXiv:2312.04567 [cs.CV]_ , 2023.
  * Fellbaum [2010] Christiane Fellbaum.  WordNet.  In _Theory and Applications of Ontology: Computer Applications_ , pages 231–243. Springer, 2010.
  * Friedrich et al. [2023] Felix Friedrich, Manuel Brack, Lukas Struppek, Dominik Hintersdorf, Patrick Schramowski, Sasha Luccioni, and Kristian Kersting.  Fair Diffusion: Instructing text-to-image generation models on fairness.  _arXiv:2302.10893 [cs.LG]_ , 2023.
  * Geirhos et al. [2018] Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel.  ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness.  In _ICLR_ , 2018.
  * Geirhos et al. [2020] Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A Wichmann.  Shortcut learning in deep neural networks.  _Nature Machine Intelligence_ , pages 665–673, 2020.
  * Goodfellow et al. [2014] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio.  Generative adversarial nets.  _NIPS_ , pages 2672–2680, 2014.
  * Goodfellow et al. [2015] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy.  Explaining and harnessing adversarial examples.  In _ICLR_ , 2015.
  * Goyal et al. [2019] Priya Goyal, Dhruv Mahajan, Abhinav Gupta, and Ishan Misra.  Scaling and benchmarking self-supervised visual representation learning.  In _ICCV_ , pages 6391–6400, 2019.
  * Guo et al. [2017] Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger.  On calibration of modern neural networks.  In _ICML_ , pages 1321–1330, 2017.
  * Hammoud et al. [2024] Hasan Abed Al Kader Hammoud, Hani Itani, Fabio Pizzati, Philip Torr, Adel Bibi, and Bernard Ghanem.  SynthCLIP: Are we ready for a fully synthetic CLIP training?  _arXiv:2402.01832 [cs.CV]_ , 2024.
  * He et al. [2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun.  Deep residual learning for image recognition.  In _CVPR_ , pages 770–778, 2016.
  * He et al. [2020] Kaiming He, Haoqi Fan, Yuxin Wu, Saining Xie, and Ross Girshick.  Momentum contrast for unsupervised visual representation learning.  In _CVPR_ , pages 9729–9738, 2020.
  * He et al. [2022a] Kaiming He, Xinlei Chen, Saining Xie, Yanghao Li, Piotr Dollár, and Ross Girshick.  Masked autoencoders are scalable vision learners.  In _CVPR_ , pages 16000–16009, 2022a.
  * He et al. [2022b] Ruifei He, Shuyang Sun, Xin Yu, Chuhui Xue, Wenqing Zhang, Philip Torr, Song Bai, and Xiaojuan Qi.  Is synthetic data from generative models ready for image recognition?  In _ICLR_ , 2022b.
  * Hendrycks and Dietterich [2018] Dan Hendrycks and Thomas Dietterich.  Benchmarking neural network robustness to common corruptions and perturbations.  In _ICLR_ , 2018.
  * Hendrycks et al. [2021a] Dan Hendrycks, Steven Basart, Norman Mu, et al.  The many faces of robustness: A critical analysis of out-of-distribution generalization.  In _ICCV_ , pages 8340–8349, 2021a.
  * Hendrycks et al. [2021b] Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song.  Natural adversarial examples.  In _CVPR_ , pages 15262–15271, 2021b.
  * Hestness et al. [2017] Joel Hestness, Sharan Narang, Newsha Ardalani, Gregory Diamos, Heewoo Jun, Hassan Kianinejad, Md Mostofa Ali Patwary, Yang Yang, and Yanqi Zhou.  Deep learning scaling is predictable, empirically.  _arXiv:1712.00409 [cs.LG]_ , 2017.
  * Ho et al. [2020] Jonathan Ho, Ajay Jain, and Pieter Abbeel.  Denoising diffusion probabilistic models.  _NeurIPS_ , pages 6840–6851, 2020.
  * Ilharco et al. [2021] Gabriel Ilharco, Mitchell Wortsman, Ross Wightman, Cade Gordon, Nicholas Carlini, Rohan Taori, Achal Dave, Vaishaal Shankar, Hongseok Namkoong, John Miller, Hannaneh Hajishirzi, Ali Farhadi, and Ludwig Schmidt.  OpenCLIP, 2021.
  * Jiang et al. [2023] Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al.  Mistral 7B.  _arXiv:2310.06825 [cs.CL]_ , 2023.
  * Kaplan et al. [2020] Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B. Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei.  Scaling laws for neural language models.  _arXiv:2001.08361 [cs.LG]_ , 2020.
  * Kar et al. [2022] Oğuzhan Fatih Kar, Teresa Yeo, Andrei Atanov, and Amir Zamir.  3D common corruptions and data augmentation.  In _CVPR_ , pages 18963–18974, 2022.
  * Karras et al. [2020] Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila.  Analyzing and improving the image quality of StyleGAN.  In _CVPR_ , pages 8110–8119, 2020.
  * Kattakinda and Feizi [2022] Priyatham Kattakinda and Soheil Feizi.  FOCUS: Familiar objects in common and uncommon settings.  In _ICML_ , pages 10825–10847, 2022.
  * Khosla et al. [2020] Prannay Khosla, Piotr Teterwak, Chen Wang, Aaron Sarna, Yonglong Tian, Phillip Isola, Aaron Maschinot, Ce Liu, and Dilip Krishnan.  Supervised contrastive learning.  _NeurIPS_ , pages 18661–18673, 2020.
  * Kingma and Welling [2014] Diederik P. Kingma and Max Welling.  Auto-encoding variational bayes.  In _ICLR_ , 2014.
  * Li et al. [2023] Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi.  BLIP-2: Bootstrapping language-image pre-training with frozen image encoders and large language models.  In _ICML_ , pages 19730–19742, 2023.
  * Liu et al. [2021] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo.  Swin Transformer: Hierarchical vision transformer using shifted windows.  In _ICCV_ , pages 10012–10022, 2021.
  * Liu et al. [2022] Zhuang Liu, Hanzi Mao, Chao-Yuan Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xie.  A ConvNet for the 2020s.  In _CVPR_ , pages 11976–11986, 2022.
  * Madry et al. [2018] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu.  Towards deep learning models resistant to adversarial attacks.  In _ICLR_ , 2018.
  * Malviya and Sudhakar [2022] Pranshu Malviya and Arjun Vaithilingam Sudhakar.  Feature diversity in self-supervised learning.  _arXiv:2209.01275 [cs.LG]_ , 2022.
  * Michaelis et al. [2019] Claudio Michaelis, Benjamin Mitzkus, Robert Geirhos, Evgenia Rusak, Oliver Bringmann, Alexander S. Ecker, Matthias Bethge, and Wieland Brendel.  Benchmarking robustness in object detection: Autonomous driving when winter is coming.  _arXiv:1907.07484 [cs.CV]_ , 2019.
  * Naeini et al. [2015] Mahdi Pakdaman Naeini, Gregory Cooper, and Milos Hauskrecht.  Obtaining well calibrated probabilities using Bayesian binning.  In _AAAI_ , pages 2901–2907, 2015.
  * Noroozi and Favaro [2016] Mehdi Noroozi and Paolo Favaro.  Unsupervised learning of visual representations by solving jigsaw puzzles.  In _ECCV_ , pages 69–84, 2016.
  * Oquab et al. [2024] Maxime Oquab, Timothée Darcet, Théo Moutakanni, et al.  DINOv2: Learning robust visual features without supervision.  _TMLR_ , 2024.
  * Parashar et al. [2024] Shubham Parashar, Zhiqiu Lin, Tian Liu, Xiangjue Dong, Yanan Li, Deva Ramanan, James Caverlee, and Shu Kong.  The neglected tails of vision-language models.  _arXiv:2401.12425 [cs.CV]_ , 2024.
  * Purushwalkam and Gupta [2020] Senthil Purushwalkam and Abhinav Gupta.  Demystifying contrastive self-supervised learning: Invariances, augmentations and dataset biases.  _NeurIPS_ , pages 3407–3418, 2020.
  * Radford et al. [2021] Alec Radford, Jong Wook Kim, Chris Hallacy, et al.  Learning transferable visual models from natural language supervision.  In _ICML_ , pages 8748–8763, 2021.
  * Richter et al. [2016] Stephan R. Richter, Vibhav Vineet, Stefan Roth, and Vladlen Koltun.  Playing for Data: Ground truth from computer games.  In _ECCV_ , pages 102–118, 2016.
  * Ricker et al. [2022] Jonas Ricker, Simon Damm, Thorsten Holz, and Asja Fischer.  Towards the detection of diffusion model deepfakes.  _arXiv:2210.14571 [cs.CV]_ , 2022.
  * Rolf et al. [2021] Esther Rolf, Theodora T. Worledge, Benjamin Recht, and Michael Jordan.  Representation matters: Assessing the importance of subgroup allocations in training data.  In _ICML_ , pages 9040–9051, 2021.
  * Rombach et al. [2022] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer.  High-resolution image synthesis with latent diffusion models.  In _CVPR_ , pages 10684–10695, 2022.
  * Rozantsev et al. [2015] Artem Rozantsev, Vincent Lepetit, and Pascal Fua.  On rendering synthetic images for training an object detector.  _CVIU_ , pages 24–37, 2015.
  * Saharia et al. [2022] Chitwan Saharia, William Chan, Saurabh Saxena, et al.  Photorealistic text-to-image diffusion models with deep language understanding.  _NeurIPS_ , pages 36479–36494, 2022.
  * Sarıyıldız et al. [2023] Mert Bülent Sarıyıldız, Karteek Alahari, Diane Larlus, and Yannis Kalantidis.  Fake it till you make it: Learning transferable representations from synthetic ImageNet clones.  In _CVPR_ , pages 8011–8021, 2023.
  * Schwarz et al. [2021] Katja Schwarz, Yiyi Liao, and Andreas Geiger.  On the frequency bias of generative models.  _NeurIPS_ , pages 18126–18136, 2021.
  * Sehwag et al. [2021] Vikash Sehwag, Saeed Mahloujifar, Tinashe Handina, Sihui Dai, Chong Xiang, Mung Chiang, and Prateek Mittal.  Robust learning meets generative models: Can proxy distributions improve adversarial robustness?  In _ICLR_ , 2021.
  * Shumailov et al. [2023] Ilia Shumailov, Zakhar Shumaylov, Yiren Zhao, Yarin Gal, Nicolas Papernot, and Ross Anderson.  The curse of recursion: Training on generated data makes models forget.  _arXiv:2305.17493 [cs.LG]_ , 2023.
  * Smith et al. [2002] Linda B. Smith, Susan S. Jones, Barbara Landau, Lisa Gershkoff-Stowe, and Larissa Samuelson.  Object name learning provides on-the-job training for attention.  _Psychological Science_ , pages 13–19, 2002.
  * Sohl-Dickstein et al. [2015] Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli.  Deep unsupervised learning using nonequilibrium thermodynamics.  In _ICML_ , pages 2256–2265, 2015.
  * Tian et al. [2023a] Yonglong Tian, Lijie Fan, Kaifeng Chen, Dina Katabi, Dilip Krishnan, and Phillip Isola.  Learning vision from models rivals learning vision from data.  _arXiv:2312.17742 [cs.CV]_ , 2023a.
  * Tian et al. [2023b] Yonglong Tian, Lijie Fan, Phillip Isola, Huiwen Chang, and Dilip Krishnan.  StableRep: Synthetic images from text-to-image models make strong visual representation learners.  _NeurIPS_ , 2023b.
  * Touvron et al. [2022] Hugo Touvron, Matthieu Cord, and Hervé Jégou.  DeiT III: Revenge of the ViT.  In _ECCV_ , pages 516–533, 2022.
  * Touvron et al. [2023] Hugo Touvron, Louis Martin, Kevin Stone, et al.  Llama 2: Open foundation and fine-tuned chat models.  _arXiv:2307.09288 [cs.CL]_ , 2023.
  * Van Den Oord et al. [2017] Aaron Van Den Oord, Oriol Vinyals, et al.  Neural discrete representation learning.  _NIPS_ , pages 6306–6315, 2017.
  * Van Horn et al. [2018] Grant Van Horn, Oisin Mac Aodha, Yang Song, Yin Cui, Chen Sun, Alex Shepard, Hartwig Adam, Pietro Perona, and Serge Belongie.  The iNaturalist species classification and detection dataset.  In _CVPR_ , pages 8769–8778, 2018.
  * Vincent et al. [2008] Pascal Vincent, Hugo Larochelle, Yoshua Bengio, and Pierre-Antoine Manzagol.  Extracting and composing robust features with denoising autoencoders.  In _ICML_ , pages 1096–1103, 2008.
  * Wightman [2019] Ross Wightman.  PyTorch image models, 2019.
  * Xiao et al. [2010] Jianxiong Xiao, James Hays, Krista A. Ehinger, Aude Oliva, and Antonio Torralba.  SUN Database: Large-scale scene recognition from abbey to zoo.  In _CVPR_ , pages 3485–3492, 2010.
  * Xiao et al. [2020] Kai Yuanqing Xiao, Logan Engstrom, Andrew Ilyas, and Aleksander Madry.  Noise or signal: The role of image backgrounds in object recognition.  In _ICLR_ , 2020.
  * Xiao et al. [2021] Zhisheng Xiao, Karsten Kreis, and Arash Vahdat.  Tackling the generative learning trilemma with denoising diffusion GANs.  In _ICLR_ , 2021.
  * Xie et al. [2020] Qizhe Xie, Minh-Thang Luong, Eduard Hovy, and Quoc V. Le.  Self-training with noisy student improves ImageNet classification.  In _CVPR_ , pages 10687–10698, 2020.
  * Xu et al. [2024] Hu Xu, Saining Xie, Xiaoqing Ellen Tan, Po-Yao Huang, Russell Howes, Vasu Sharma, Shang-Wen Li, Gargi Ghosh, Luke Zettlemoyer, and Christoph Feichtenhofer.  Demystifying CLIP data.  In _ICLR_ , 2024.
  * Zhang et al. [2019] Liheng Zhang, Guo-Jun Qi, Liqiang Wang, and Jiebo Luo.  AET vs. AED: Unsupervised representation learning by auto-encoding transformations rather than data.  In _CVPR_ , pages 2547–2555, 2019.
  * Zhang et al. [2016] Richard Zhang, Phillip Isola, and Alexei A Efros.  Colorful image colorization.  In _ECCV_ , pages 649–666, 2016.
  * Zhou et al. [2017] Bolei Zhou, Agata Lapedriza, Aditya Khosla, Aude Oliva, and Antonio Torralba.  Places: A 10 million image database for scene recognition.  _TPAMI_ , pages 1452–1464, 2017.
  * Zhou et al. [2023] Yongchao Zhou, Hshmat Sahak, and Jimmy Ba.  Training on thin air: Improve image classification with generated data.  _arXiv:2305.15316 [cs.CV]_ , 2023.