1258 IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS, VOL. 40, NO.
6, JUNE 2021
REIN the RobuTS: Robust DNN-Based Image
Recognition in Autonomous Driving Systems
Fuxun Yu , Zhuwei Qin , Chenchen Liu, Di Wang , and Xiang Chen , Member, IEEE
Abstract—In recent years, the neural network (NN) has shown
its great potential in image recognition tasks of autonomous
driving systems, such as traffic sign recognition, pedestrian detec-
tion, etc. However, theoretically well-trained NNs usually fail
their performance when facing real-world scenarios. For exam-
ple, adverse real-world conditions, e.g., bad weather and lighting
conditions, can introduce different physical variations and cause
considerable accuracy degradation. As for now, the generaliza-
tion capability of NNs is still one of the most critical challenges
for the autonomous driving system. To facilitate the robust image
recognition tasks, in this work, we build the RobuTS dataset: a
comprehensive Robust Traffic Sign Recognition dataset, which
includes images with different environmental variations, e.g.,
rain, fog, darkening, and blurring. Then to enhance the NN’s gen-
eralization capability, we propose two generalization-enhanced
training schemes: 1) REIN for robust training without data in
adverse scenarios and 2) Self-Teaching (ST) for robust training
with unlabeled adverse data. The great advantages of such two
training schemes are they are data-free (REIN) and label-free
(ST), thus effectively reducing the huge human efforts/cost of on-
road driving data collection, as well as the expensive manual data
annotation. We conduct extensive experiments to validate our
methods’ performance on both classification and detection tasks.
For classification tasks, our proposed training algorithms could
consistently improve model performance by +15%–25% (REIN)
and +16%–30% (ST) in all adverse scenarios of our RobuTS
datasets. For detection tasks, our ST could also improve the detec-
tor’s performance by +10.1 mean average precision (mAP) on
Foggy-Cityscapes, outperforming previous state-of-the-art works
by +2.2 mAP.
Index Terms—Autonomous driving, deep neural network (NN),
robust image recognition.
I. I NTRODUCTION
N RECENT years, neural network (NN) with exceptional
I performance shows its great potential in autonomous driv-
ing systems [1]–[3]. However, an NN with 100% accuracy
in theoretical testing is still not ready-to-go with cars. Many
practical factors will affect the NN performance, such as differ-
ent weathers, lighting conditions, camera/sensor discrepancy,
Manuscript received March 1, 2020; revised June 21, 2020; accepted
September 28, 2020. Date of publication October 23, 2020; date of current
version May 20, 2021. This work was supported in part by the NSF under
Grant 1717775. (Corresponding author: Fuxun Yu.)
Fuxun Yu, Zhuwei Qin, and Xiang Chen are with the School of Electrical
and Computer Engineering, George Mason University, Fairfax, VA 22030
USA (e-mail: fyu2@gmu.edu).
Chenchen Liu is with the Department of Computer Science and Electrical
Engineering, University of Maryland, Baltimore County, Baltimore, MD
21250 USA.
Di Wang is with Microsoft Cognition, Microsoft, Redmond, WA 98052
USA.
Digital Object Identifier 10.1109/TCAD.2020.3033498
0278-0070 
c 2020 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See https://www.ieee.org/publications/rights/index.html for more information.
Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
etc. [4]–[6]. These factors may introduce unexpected varia-
tions to the real-world images, which are beyond the limited
training data and can cause considerable accuracy degradation.
As shown in Fig. 1(a), traffic sign examples under adverse
weather conditions are wrongly classified by a well-trained
model. Such situations can cause severe safety issues, e.g.,
several autonomous driving accidents due to the self-driving
system error have already been reported during the last few
years [7]–[10].
The current autonomous driving systems’ inability with
the real-world variations demonstrates the functionality flaw
of state-of-the-art NNs, i.e., the insufficient generalization
capability. Generalization describes a model’s capability to
extend its functionality from finite training cases into infi-
nite unseen testing scenarios. To enhance the generalization
ability of autonomous driving systems, many research works
have emerged: Lim et al. [11] targeted at traditional data
augmentation techniques, i.e., trying to include as much
full-annotated training examples under adverse weather con-
ditions as possible, including rainy and cloudy images; and
Tian et al. [7] proposed an NN verification and testing system.
By large amounts of simulated scenarios, they could help find
existed corner cases that autonomous driving systems may
fail to operate correctly; several other works aim to recog-
nize and remove the practical variations from the real-world
captured image, therefore restoring theoretical clean testing
scenarios [4], [5], [12], [13].
Although these proposed works help alleviate the problems
to some extent, they are mainly focusing on “compensating”
the NN generalization ability with large amounts of aux-
iliary data and post-training efforts. Rather than enhancing
the generalization ability, most of the methods fell into con-
structing case-specific or scenario-specific networks, which
can cover limited scenarios only and may still fail under new
unexpected conditions. By comparison, another common prac-
tice of industry is to collect tremendous amounts of data by
thousands-of-hours on-road driving, hoping these training data
would cover as many as possible corner cases to enable the
model’s generalization capability in the real world. However,
such practice comes with not only huge human driving efforts
(in years) but also produce raw thousands-of-hours data, which
demands huge human annotation cost.
In this work, we focus on improving the generaliza-
tion performance of two subtasks in autonomous driv-
ing systems: 1) robust traffic sign classification and
2) object detection tasks. Specifically, we have the following
contributions.
YU et al.: REIN RobuTS: ROBUST DNN-BASED IMAGE RECOGNITION IN AUTONOMOUS DRIVING SYSTEMS
(a)
Fig. 1. System overview. (a) DNN model’s accuracy can degrade significantly in adverse weathers. We propose two training schemes to enhance model
generalization in adverse weathers targeting at two scenarios: (b) with only clean training data available: REIN and (c) with extra unlabeled training data in
adverse conditions: ST.
1) First, we build a comprehensive RobuTS dataset to facil-
itate the Robust Traffic Sign recognition research. The
dataset contains a large amount of traffic sign images
under four different weather conditions with varied
variation intensities, e.g., rain, fog, day/night lighting,
blurring, etc. Dataset will be open sourced for research
purposes.
2) We benchmark a state-of-the-art NN-based traffic sign
classifier on our RobuTS dataset, which effectively helps
indicate the existed weakness and performance flaw of
the well-trained classifier, giving valuable feedback on
the potential enhancement directions.
3) We analyze the influence of different practical variations
and summarize these practical variation models into one
unified model. Guided by the unified model, we propose
REIN: a robust and efficient training approach, which
could significantly improve the model generalization but
without the needs to utilize extra data during training.
4) Considering the potentially large amounts of unlabeled
data available, we also propose the ST algorithm, which
could combine the labeled clean data and the unlabeled
data under adverse conditions to enhance the model’s
generalization capability during training;
5) Finally, we implement our training methods and evalu-
ate the generalization enhancement on both our RobuTS
dataset and the common FoggyCityscapes detection
benchmark, which demonstrates our methods’ effective-
ness and huge potential in autonomous driving system.
Experiments show that on our RobuTS classification dataset
(rainy, fogy, darkening, and bokeh/motion blurring), the
performance of a well-trained model with 96% accuracy can
dramatically degrade by −40%–60%. In such cases, both
REIN and ST training method could bring model signifi-
cant generalization improvement, achieving consistent better
performance and bringing +15%–25%, +16%–30% accu-
racy improvement in all practical scenarios. Meanwhile, on
object detection, such as vehicle/pedestrian detection tasks,
Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
1259
(b)
(c)
our ST could also bring +10.1 mean average precision (mAP)
performance improvement, outperforming recent state-of-the-
art works by +2.2 mAP. Besides, the REIN and ST training
method requires either no extra training data or extra anno-
tations in these scenarios, which can save a lot of on-road
driving data collection cost, or huge human annotation efforts.
To interpret the improvement of our training method, we also
conduct gradient analysis and NN visualization, showing that
our generalization-enhanced model could better capture the
main features of image content, which could be the potential
reason for our generalization improvement.
II. P RELIMINARY
In this section, we briefly review the background for deep
NNs applied in autonomous driving systems and introduce sev-
eral common practical variations of traffic sign images in the
on-road driving scenarios.
A. Neural Networks in Autonomous Driving
There are several major subtasks in autonomous driving
systems, including image classification tasks, like traffic sign
classification; object detection tasks, like vehicle/pedestrian
detection [14]; lane detection tasks [15]; etc. Recently with
the fast development of deep learning, NN-based models have
been widely utilized and achieve great performance in such
tasks [16], [17].
In this work, we take both the image classification and
object detection subtasks in autonomous driving systems as
our target applications. Take the classification task as an exam-
ple, convolutional NN is the most popular model due to its
exceptional performance in image classification tasks [18].
Currently, in clean testing scenarios, the state-of-the-art traffic
sign classification model [19] could usually achieve over 99%
accuracy on Germany Traffic Sign recognition Benchmark
(GTSRB) [20]. Such performance is considered as the pri-
mary achievement of the NN in autonomous driving systems.
1260 IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS, VOL. 40, NO. 6, JUNE 2021
However, such strong models often appear to have low
accuracy when applied to practical cases with unexpected
variations, so does the state-of-the-art detection model.
B. Performance Degradation With Practical Variations
The input examples of real-world traffic signs usually con-
tain various kinds of practical variations, such as rain [4],
fog [5], different ambient light conditions [11], camera/sensor
discrepancy [21], etc. However, these unexpected practical
variations are usually beyond the clean training dataset, and
thus can easily corrupt the NN classification accuracy. For
example, previous works have demonstrated thousands of erro-
neous behaviors across three top-performing DNNs in the
Udacity self-driving car challenges due to such practical varia-
tion [7], [22]. Once such erroneous behaviors are incurred, the
steering or speed modules can fail to work correctly and the
performance degradation would cause critical safety issues in
real-world autonomous driving systems. Several autonomous
driving accidents due to the self-driving system error have
already been reported during the last few years [8]–[10], which
has raised customers’ great concern in autonomous driving
security.
Based on the previous research work, several representative
practical driving-variation scenarios can be categorized and are
taken into consideration in our work.
1) Weather Conditions: Rain, fog/haze, snow, etc. [4], [5].
2) Ambient Light Variation: Day/Night, cloudy, etc. [11]
3) Camera Discrepancy: Camera aging, blurring, etc. [21].
4) Others: Camera perspective, occlusion, etc. [21].
These environmental factors can cause different variations
in the camera-captured street scene images. When such varia-
tion intensity is high, the NN-based classification or detection
system can be highly likely to mispredict the captured images.
In the next section, we take the classification task as an
example and choose four representative practical variations to
demonstrate the current flaw of NN-based systems. And then
we introduce our RobuTS dataset, which could help evaluate
and demonstrate the influence of such practical variations on
the NN-based classification system.
III. ROBU TS: ROBUST T RAFFIC S IGN
R ECOGNITION DATASET
In this section, we introduce our RobuTS dataset for robust
traffic sign recognition. We choose four representative driv-
ing scenarios, i.e., the commonly seen rain and fog as the
weather cases, darkening effect as the ambient light case, and
bokeh/motion blurring as the camera discrepancy case. We
use image synthesizing to generate the new RobuTS dataset
with the seed images from GTSRB dataset [20]. To do so, we
detailedly model the four different practical variations based
on previous research and synthesize new traffic sign images
with different variations and in varying intensities. After syn-
thesizing the new dataset, we then benchmark a state-of-the-art
NN-based classifier on the new RobuTS test sets and demon-
strate the model’s poor generalization capability as it shows
significant performance degradation.
Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
A. Practical Variation Modeling With Traffic Signs
1) Rain Variation: Physically, raindrops are uniformly dis-
tributed in space and the drop size follows the Marshal–Palmer
distribution for a given rain rate [4], [12]. During the camera
exposure time tcam , the drop with speed vrain covers a distance
of length lrain = tcam ∗vrain [12]. The color of raindrops is white
with certain opacity α due to its motion blur [12]. Therefore,
the rain variation could be modeled as
Xrain = M(p) × Xorg + α(1 − M(p)) × Rain (1)
where Xorg and Xrain denote the original and the observed
image. M(p) denotes the raindrop position matrix with pixel
index p. And α is the raindrop opacity. ω is the sum of
nonzero positions in M(p), denoting the number of raindrops
and thus is used to simulate the different rainfall intensity. The
synthesized rainfall images are shown in Fig. 2(a).
2) Fog Variation: Based on the atmospheric optics [13], the
observed color of a camera-captured image in the presence of
fog/haze can be modeled as follows:
Xfog = (1 − t(p)) × Xorg + t(p) × A (2)
where A = (Ar , Ag , Ab )T is the global atmospheric light that
represents the ambient light in the atmosphere. Also, t(p) is
inversely proportional to the scene depth and fog intensity
since fog and long distance will scatter and attenuate the light
during transmission. The larger t(p) is, the image itself will
be vaguer. Therefore, we use parameter t(p) to control the fog
intensity. The synthesized fogy images are shown in Fig. 2(b).
3) Darkening Effect: One important factor for driving is
enough ambient light. In our simulation, we change the image
brightness to simulate the darkening effect. In image process-
ing, adjusting brightness equals to add a constant offset to each
channel for the R,G,B fields of an image. Therefore to get a
darker image, we add a negative constant to every channel.
The ambient light condition can be modeled as
Xlight = Xorg ± β × A (3)
where β controls the darkening intensity. The finally syn-
thesized images with the darkening effect are shown in
Fig. 2(c).
4) Bokeh/Motion Blurring: In the camera exposure, the
bokeh blur is one common phenomenon, which is the aes-
thetic quality of the blur produced in the out-of-focus parts of
an image produced by a lens [23]. Meanwhile, the fast moving
and car vibration will also introduce the blurring effect. In
our simulation, we use the Gaussian blur to simulate the
blurring effect, which is generated by convolving an image
with a Gaussian kernel. The standard deviation δ controls the
intensity of blurring. The blurring effect can be modeled as
Xblur = Gaussian(δ) ∗ Xorg (4)
where Gaussian(δ) denotes the Gaussian kernel with zero
mean and standard deviation δ, which controls the varia-
tion intensity. And ∗ denotes the convolution operation. The
synthesized blurred images are shown in Fig. 2(d).
YU et al.: REIN RobuTS: ROBUST DNN-BASED IMAGE RECOGNITION IN AUTONOMOUS DRIVING SYSTEMS
Fig. 2. Practical variation modeling and synthesis effect in four scenarios: rain drops, fog variation, darkening effect, and bokeh/motion blurring. With the
highest variation intensity (0 → 1), the traffic sign images are still relatively clear to human drivers, but the NN-based classifier’s accuracy drops significantly
by 40%–60% in all four scenarios.
B. RobuTS Dataset Synthesis
After the modeling, we can generate our new robust traf-
fic sign recognition dataset containing traffic sign images
with the aforementioned variations. As we have demonstrated
before, the intensity for all the above variation modeling
can be controlled by a parameter with a specific physical
meaning. Therefore, we synthesized images of varying inten-
sities for each variation in order to analyze the full-spectrum
environmental influence.
Synthesis Setup: Our seed traffic-sign images are from the
GTSRB dataset [20], containing 39 209 training and 12 630
test samples, which include totally 43 classes of traffic sign
images (32×32×3). For each seed image, we would synthesize
new images with four types of variations. As for the intensity
in each scenario, the upper bound intensity is selected so that
the traffic signs are still clearly visible to a human observer
in the most intense setting. Then for each seed image, we
set 20 intervals for the intensity in that range and generate
20 images with different intensities to cover the full-spectrum
variation changing for our research analysis. The intensity is
then normalized in the range of 0 to 1. For all generated traffic
sign images with different physical variations, the labels are
kept consistent with their original ones.
Dataset Overview: After synthesis, our RobuTS dataset
contains one million images of traffic signs with different
synthesized physical variations (784 180 training and 252 600
testing) beyond the seed dataset GTSRB. For each traffic sign
image, besides the original normal version, it comes with four
other driving scenarios: 1) rain; 2) fog; 3) darkening; and 4)
blurring, and with 20 different variation levels for each sce-
nario. The RobuTS dataset and synthesis code will be open
sourced for public research upon publication.
Our RobuTS dataset is a comprehensive dataset toward eval-
uating the NN’s robust traffic sign recognition capability with
various practical variations. For a traffic sign classification
system, evaluation on RobuTS can help the developer to find
the system’s potential weakness and performance flaw, giving
valuable feedback of enhancement directions. As an example,
in the next section, we benchmark a well-trained NN from
Udacity Self-Driving Challenge [22] on our RobuTS test set,
demonstrating its non-negligible weakness facing the adverse
practical conditions.
Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
1261
C. Benchmarking Neural Network on the RobuTS Dataset
In this section, we benchmark the state-of-the-art NN clas-
sifier on our RobuTS dataset. By testing with four different
variations, we demonstrate such an NN-based classifier’s
potential weakness in practical driving scenarios.
Benchmarking Setup: We adopt the CNN-based classifier
from Udacity Self-Driving Challenge [22]. The model is
trained on the original GTSRB training set and could achieve
96.0% accuracy on the original clean test set. The model is
then evaluated on our RobuTS test set within all four scenar-
ios. For each variation scenario, 20 different variation intensity
levels are tested, and the results are shown in Fig. 2(4).
Results and Analysis: Overall, we can find that the model’s
classification accuracies in all test scenarios demonstrate large
extents of degradation, e.g., from 96% to average below 50%.
1) Rain Variation: Rain variation shows the most influence
on accuracy even in the very beginning stage. The test-
ing accuracy drops to 56% (−40%) at half variation
intensity, and finally arrives 50% (−46%).
2) Fog Variation: Fog variation seems to be less influential
than rain, but still, it causes the model accuracy to drop
to 60% (−36%) at the full intensity.
3) Darkening Variation: The accuracy dropping is simi-
lar to fog variation, but darkening causes a relatively
larger accuracy drop. The accuracy finally drops to
45% (−51%).
4) Blurring Variation: The blurring effect hurt the image
edges most, and the accuracy finally drops to the lowest
20% (−76%) with full-intensity blurring.
Clearly, we can find the NN-based classifier demonstrates
significant performance drops when facing practical variations,
although the traffic sign images are still highly distinguishable
to human observers even with the highest variation intensity.
We show several example images with three levels of inten-
sities (0 → 0.5 → 1) in each scenario [Fig. 2(3)], where the
traffic signs still seem relatively clear. This proves the NN-
based system’s susceptibility to practical variations and also
implies the NN’s limited generalization capability in complex
real-world scenarios. To enhance the generalization capability
of such NN-based traffic sign classifiers, in the next section, we
analyze the underlying reasons and propose our REIN training
algorithms.
1262 IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS, VOL. 40, NO. 6, JUNE 2021
IV. REIN: ROBUST AND E FFICIENT T RAINING W ITHOUT
C OLLECTING A DVERSE DATA
In this section, we first analyze the underline influencing
mechanism of these variations to the NN. We then define a uni-
fied model by utilizing the first-order gradient to evaluate the
variation influence, as well as the NNs’ generalization capa-
bility. Guided by it, we formulate a new training loss function
to enhance the model generalization by regulating the first-
order gradient magnitude. Also, the double-backpropagation
technique [24] is used in the training process for second-
order gradients calculation. Finally, we give an overview of
our generalization-enhanced training algorithm.
A. Theoretical Generalization Problem Abstraction
Suppose we have a natural image input x, e.g., a 32×32×3
traffic sign image. The practical variation could be denoted
by x. Note that x is usually small/moderate and will not
influence the main pattern of original image x. The NN could
be seen as a large-scale nonlinear function Fθ (x) composed
of massive volumes of neurons, where θ is network’s weights
and bias values. As a result, the NN classification failure cases
could be denoted as
Fθ (x + x) = Fθ (x)
which means, added with some variation x, the classification
result of NN changes to a wrong label which is different from
the original correct prediction.
According to first-order Taylor expansion, we can linearly
approximate the NN function F(x + x) at the neighborhood
of x to the following format:
∂Fθ (x)
Fθ (x + x) = Fθ (x) + × x (6)
∂x
where ∂Fθ (x)/∂x is the first-order gradients of function Fθ (x).
Combining (5) and (6), we could then calculate that the
influence on NN brought by x is
∂Fθ (x)
Effect(x) = Fθ (x + x) − Fθ (x) = × x. (7)
∂x
From the conclusion in (7), we show that the influence of
variation x on NN Fθ (x) can be approximated to be linearly
correlated with the gradient ∂Fθ (x)/∂x. In other words, gra-
dients could be seen as the amplification coefficients of small
variation x. The larger the gradients are, the more influence
will be brought by the small variations.
Fig. 3 illustrates the relationship between gradients and the
influence of x by showing two NN’s decision boundaries.
The network with larger first-order gradients [Fig. 3(a)] will
form a function surface with steeper slopes (gradients). For
one natural traffic sign image of class Priority Road, if we
add some small variation into the image, the network with
larger gradients are more susceptible to misclassify it: the rain
variation ’s influence might push the output across the decision
boundary (violet surface), and then change the classification
results to Yield. In contrast, NN with smoother decision bound-
ary [Fig. 3(b)] is more resistant to such small variations,
because all its decision surface neighbors are still in the same
class.
Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
To conclude, the network’s resistance of small variation x
is inversely proportional to its gradients magnitude. That is to
say, NN with high generalization ability should have as small
first-order gradients as possible. Therefore, in the next sec-
tion, we will introduce gradient regularization, i.e., regulating
the network’s gradient magnitude to be small in the training
process for generalization-enhancement purpose.
B. Generalization-Enhanced Training Loss Formulation
As aforementioned, large first-order gradients might amplify
small variations and then influence the classification results.
Therefore, in the training process, we should enforce network
gradients to be as small as possible while maintaining the same
accuracy. As loss function could be used in training process to
update the network parameters to satisfy certain constraints,
we introduce the gradient loss penalty Lgrad into the network
training loss function
Lθ (x) = Lce + c · Lgrad
 
∂Regθ (x)
where Lgrad = Lnorm (8)
∂x
where θ is network parameters, Lce is normal cross-entropy
(5) loss and Lgrad is the gradient loss penalty we added.
∂Regθ (x)/∂x is the Jacobian matrix of our regularizer function
Regθ (x), and Lnorm could be l1 , l2 , or l∞ norm. The coefficient
c here is used to adjust the gradient loss penalty strength so
that it will not harm the accuracy in the training process.
As for the regularizer function Regθ (x), it could be the soft-
max outputs, or the logit outputs of the network function,
Fθ (x). Here, we choose to use the logit outputs since it could
preserve most of the useful information before the softmax
operation. The regularizer function is defined as follows:
Regθ (x) = max{Z(x)i , i = t} − Z(x)t (9)
where Z(·) is the logits output before the softmax layer, and t
is the input x’s correct label. This regularizer function Regθ (x)
could be interpreted as the difference between the maximum
wrong logits and the correct ones. As long as we could main-
tain the gradients of this function to be small, the small
variation x s influence on this function would be limit to be
smallest. That is to say, the wrong logits will not easily exceed
the correct ones and thus will not cause the wrong classifica-
tion. Therefore, the network’s resistance to small variations
x could be improved to the maximum extent.
C. Gradients Descent With Double Backpropagation
General network training process is usually done by the
stochastic gradient descent algorithm. As in normal gradi-
ent descent, every parameter is updated using the following
equation:
 
∂Lce
θ  = θ − lr · (10)
∂θ
where lr is the learning rate. However, in our defined train-
ing loss function, first-order gradient penalty Lgrad is included.
As a result, different from normal gradient descent problems,
YU et al.: REIN RobuTS: ROBUST DNN-BASED IMAGE RECOGNITION IN AUTONOMOUS DRIVING SYSTEMS
Fig. 3. REIN: robust training with gradient regularization. An NN model should have a smooth decision boundary so that small variations (e.g., rains) cannot
change its prediction easily. Through gradient regularization, i.e., regulating gradient magnitudes in training loss, we could improve NN’s decision boundary
smoothness, thus enchaining NN’s generalization capability.
introducing the gradient loss into the training loss needs us to
solve a second-order gradient computation problem.
To compute the second-order gradients, we adopt the
double-backpropagation technique as the solution [24]. In dou-
ble backpropagation, we first compute the cross-entropy and
gradient loss by forward propagation, with the gradients then
being calculated by backpropagation. Then, to minimize the
gradient loss Lgrad , we need to calculate the second-order
derivative of Lgrad . Therefore, a second backpropagation oper-
ation is performed to compute the second-order derivative
of Lgrad on θ . After this, the weights of NNs are updated
according to the gradient descent equation
    
 ∂Lce ∂Lnorm ∂Regθ (x)/∂x
θ = θ − lr · − lr · (11)
∂θ ∂θ
where −(∂Lce /∂θ) is the first-order gradients to minimize
the cross-entropy, and −([∂Lnorm (∂Regθ (x)/∂x)]/∂θ) is the
second-order partial derivative to minimize the gradients loss.
D. Generalization-Enhanced Training Overview
In summary, our generalization-enhanced training method
introduces a new gradient penalty loss in the normal training
procedure to regulate the gradient magnitude to be as small
as possible. And the second-order gradients can be solved by
adopting the double-backpropagation algorithm. As shown in
Fig. 3, during the REIN training, model’s large gradients will
be penalized through the whole training procedure, so the final
formed decision boundary will be smoother than the naturally
trained model. At the meantime, the model accuracy could be
well preserved by controlling the penalty coefficients c. As a
result, we could effectively improve the network’s generaliza-
tion ability among practical varied scenarios. Furthermore, one
advantage of our algorithm is that our training method does not
need to collect scenario-specific training data. In autonomous
driving systems, this could save thousands miles of on-road
driving data collection, which has great practical significance.
As for the extra cost of our training algorithm compared to
natural training, except that double backpropagation costs one
more backpropagation per training iteration, no other training
overhead is introduced into our training process. Meanwhile,
we could maintain the convergence speed at the same order
Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
1263
as natural training without sacrificing the training efficiency,
as we will show in the later experiments.
V. S ELF -T EACHING : ROBUST T RAINING W ITH
U NLABELED P RACTICAL DATA
The robust training algorithm, REIN, could achieve general
robustness against various variations without using any extra
training data with practical variations. In many real cases,
the raw practical training data can sometimes be available
through onboard recording cameras and sensors. For exam-
ple, to facilitate the auto-pilot system development, Tesla has
announced its data sharing policy, including collecting driving
scene videos on customers’ cars in order to improve self-
driving performance [25]. With millions of customers driving
on road, collecting large amounts of raw data within all kinds
of scenarios becomes simple. However, the labeling cost for
these raw but complex driving data can be very huge. This
leaves a huge amount of unlabeled data within all practi-
cal scenarios unused, which has great potential to improve
self-driving system’s performance.
Targeting at this problem, in this section, we propose a novel
training method to utilizing such unlabeled data, ST. By our
novel ST algorithm, we could further improve the NN’s robust-
ness against practical variations by utilizing unlabeled practical
data.
A. Self-Teaching Overview
The ST algorithm originates from semisupervised learning
problem where the data labeling is incomplete, i.e., partial data
is labeled but the others are unlabeled [26], [27]. The main
idea is to first use labeled data to train the learning system,
and then use the trained system itself as a teacher to (pseudo-
)annotate the unlabeled data. Finally, by combining data with
real labels and data with pseudo-labels, the learning system
could be retrained to achieve better performance. This process
could be iterated multiple times until convergence.
Problem Setting: In our problem, for the labeled training
data, we assume all the clean traffic sign images in GTRSB
are available with labels, which are denoted as (Xs , Ys ). In
contrast, all the traffic sign images with synthesized practical
1264 IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS, VOL. 40, NO. 6, JUNE 2021
(a)
Fig. 4. Overview of the ST algorithm. (a) In the initial step, we first use the labeled clean data to train an initial annotator model and predict the initial
pseudo-labels on the adverse data. (b) Then, both clean and adverse data will be involved into ST. During the iterative ST, the model performance can be
improved. Therefore, the pseudo-labels will also be relabeled by the better annotator to further improve the ST performance.
variations are assumed to be realistic data collected on-road
but without annotations. This part of data is denoted as (Xt , ?)
where ? denotes unknown labels. Our major task is to train
an effective and generalizable NN-based classifier F that can
perform classification tasks well on both regular data, Xs , and
data with variations, Xt .
Algorithm Overview: Fig. 4 shows the overview of our ST
algorithm, which is an iterative training process. In the first
iteration, we use the labeled data (Xs , Ys ) to train the classifier
with regular cross-entropy loss, i.e.,

N
Minimize −ys logF(xs ) + (1 − ys )logF(xs )
i
where N is the number of images with labels.
After the initial training process, we could get a well-trained
classifier F, which will then be used to generate pseudo-
labels Yt on the unlabeled raw data Xt . However, directly
applying the classifier F onto the new data can generate erro-
neous pseudo-labels due to the intense practical variations.
Without precautions, these wrong pseudo-labels can signifi-
cantly hinder the following ST process. Therefore, we conduct
confidence-based thresholding to choose the most confident
pseudo-labels as they are most likely to be the correct ones.
Specifically, the pseudo-label choosing criteria is depending
on whether the pseudo label’s largest confidence is higher than
a predefined confidence threshold θ . If so, it is labeled as the
class with the highest confidence; otherwise, it is not annotated
and remains unlabeled in the following iteration:
arg maxi (pi ), max(pi ) > θ
yt =
none, otherwise
where pi is the predicted probability of each class i for image
xt , and yt is the output pseudo-label.
After the pseudo-label annotation process, we can get the
extra pseudo-labeled data (Xt , Yt ) from all possible scenarios.
Here, Yt denotes the pseudo-labels generated by the previous
annotating process. With these extra images with various prac-
tical variations, we could then conduct retraining by combining
Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
(b)
both data sources (Xs , Ys ) and (Xt , Yt ) to improve classifier F  s
performance on such new data

Minimize −ys logF(xs ) + (1 − ys )logF(xs )
  
+ −yt logF(xt ) + 1 − yt logF(xt ). (14)
Through the combined learning process, this would allow
the classifier to extra knowledge from not only regular data
but also practical data with various scenario variations, greatly
enhancing its generalization capability and improving accuracy
in these unlabeled practical scenarios.
The above process completes the first iteration of the ST
(12) algorithm. Since we get a better classifier F than the initial
one, the more accurate pseudo-labels could be also obtained
by applying the new classifier to reannotate. Therefore, the ST
algorithm reiterates the annotation process and reconduct the
data-combined training to get increasingly better classifier and
better pseudo-labels. The iteration process stops when achiev-
ing the upper bound performance. And the pseudocode of the
ST algorithm is given in Algorithm 1.
As we can see, throughout the iterations, the classifier F
performs as the teacher to generate pseudo-labels as its super-
vision, while it also acts as the student who relearns that from
the real-labeled and pseudo-labeled supervision. Therefore, it
is named the ST algorithm. ST could greatly boost the classi-
fier performance by involving large amounts of realistic data
with practical variations. Meanwhile, since the training data
already covers as many as practical scenarios, the generaliza-
tion capability of the classifier could also be greatly enhanced,
as we will show in the later experiments.
(13)
B. Self-Teaching Optimizations
ST improves the classifier’s performance mainly by training
with new images and the corresponding generated pseudo-
labels. However, as we know that, the pseudo-labels generated
by the classifier inevitably contain certain errors. Even though
with the confidence-based thresholding, certain erroneous
pseudo-labels can still exist. When applying naive ST training,
these wrong labels can cause error accumulation: During the
YU et al.: REIN RobuTS: ROBUST DNN-BASED IMAGE RECOGNITION IN AUTONOMOUS DRIVING SYSTEMS
Algorithm 1 ST Algorithm
1: procedure I NITIALIZATION (A)
2: Input: Clean data [xs , ys ], Adverse data [xt , ?]
3: Initialize Model F
4: while not converge do
5: Train F using [xs , ys ];
6: Update F according to Eq. (12);
7: end while
8: Get pseudo label yt using F(xt ) by Eq. (13)
9: Return [xt , yt ]
10: end procedure
11: procedure I TERATIVE S ELF -T EACHING (B)
12: Input: Clean data [xs , ys ], Adverse data [xt , yt ]
13: Initialize Model F 
14: while not converge do
15: Train F  using [xs , ys ] and [xt , yt ];
16: Update F  according to Eq. (14);
17: end while
18: Update pseudo label yt using F  (xt ) by Eq. (13)
19: Retrain model F and iterate until convergence.
20: Return model F
21: end procedure
following training process, some wrong pseudo-labels are used
as ground-truth labels and classifier F will further reinforce
their wrong prediction results on such images. Even worse,
more classification errors will appear on similar images due
to the wrong supervision.
To avoid the influence of such error accumulation, we
further propose some optimizations on ST: 1) curricu-
lum learning; 2) imbalanced sampling; and 3) progressive
confidence-based thresholding.
Curriculum Learning: To avoid the overwhelming effects
produced by erroneous pseudo-labels, we first optimize the ST
algorithm following the practice of curriculum learning. When
combining the pseudo-labeled dataset into ST, we use an easy-
to-hard way to involve the pseudo-labeled training data. That
is, we first introduce images with smaller-intensity variations
since their pseudo-label accuracy is higher than the ones with
more intense variations. When the model has learned to clas-
sify these images well, the model thus can also generate more
accurate pseudo-labels on the images with higher-intensity
images. Therefore, we will gradually introduce more images
with higher-intensity variations, i.e., a curriculum ST prac-
tice. As we will show later, under certain scenarios when
pseudo-label accuracy is relatively low, the curriculum learn-
ing is essential to ensure the significant improvement of the
ST algorithm.
Imbalanced Sampling: After following the curriculum learn-
ing practice, we still have both data sources: 1) the data with
accurate real labels and 2) the data with pseudo-labels, which
may not be perfectly accurate. And all real and pseudo-labels
are sampled randomly between two data sources. However,
when the pseudo-labels contain too many errors, the gradient
descent on one mini-batch can produce overwhelming wrong
gradients that hurt the training performance.
Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
1265
Therefore, when combined two data sources during the
training process, we conduct imbalanced sampling, i.e., to
oversample the real labels but undersample the pseudo-labels
in every mini-batch. Thus, we could ensure that most image
samples in every mini-batch are accurately labeled and can
produce useful gradient information. By imbalanced sampling
optimization, the ST process could achieve better performance
than naive random sampling, as we will show later.
Progressive Confidence Thresholds: The last optimization
we conduct is on the confidence threshold. Based on our
assumption, the confidence threshold θ controls the pseudo-
label quality. A higher θ can produce more accurate pseudo-
labels and vice versa. But higher θ also cause another issue
that most data will remain unlabeled since their pseudo-label
confidence cannot achieve the threshold based on (13).
To tradeoff the pseudo-label quality and amount, we thus
propose progressive confidence thresholds. In the beginning
iterations, we set high confidence thresholds θ to ensure the
high label quality. With more training iterations, classifier F
could progressively learn to classify more unlabeled data cor-
rectly. Thus, in the later iterations, we could then lower the
thresholds to include larger amount of new training data to
further enhance the model performance.
Overall, REIN and ST are both robust training algorithms
toward enhancing the NN-based traffic sign classification
system’s generalization capability. Compared to the REIN
training algorithm which does not require any extra train-
ing data in adverse conditions, the self-training provides
another alternative, i.e., utilizing the potentially available unla-
beled training data to enhance the generalization, which could
get higher performance but also avoids the huge annotation
cost. In the next two sections, we evaluate the performance
of both algorithms and demonstrate their great performance
improvement in terms of generalization enhancement.
VI. E XPERIMENTS AND E VALUATION FOR REIN:
ROBUST T RAINING W ITHOUT P RACTICAL DATA
In this section, we evaluate the performance of our robust
training method REIN on traffic sign classification tasks.
Experiment Setup: We use the GTRSB dataset as the source
dataset for model training in the experiments. Before train-
ing, data augmentation techniques, including scaling, random
cropping, and rotating, are used. The base model we use is
the convolutional NN similar to what we used in Section III.
Two raw models are then trained by natural training and
our generalization-enhanced training method REIN, using
Momentum Optimizer with 5e-3 learning rate in Tensorflow-
1.6 [28]. All other training configurations are kept the same
for a fair comparison. The two trained models are then
named natural model and generalization-enhanced model,
which achieve 95.8% and 94.4% accuracy, respectively. For
the accuracy of clear testing images, the robust training method
is slightly lower (−1.4%) than regular model training due to
the gradient penalty, which we will discuss later. But under
all practical scenarios with variations, we will demonstrate
that our method could greatly outperform the natural models
by +15%–25%.
1266 IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS, VOL. 40, NO. 6, JUNE 2021
(a) (b)
Fig. 5. REIN effectiveness evaluation: natural model versus generalization-enhanced model by REIN. With four different kinds of practical variations on traffic
sign images, our generalization-enhanced model consistently outperforms the natural model by large margins, achieving +15%–25% accuracy improvement
at the highest variation intensity.
Fig. 6. Natural and adversarial examples (with adversarial noises) look very
similar, but adversarial ones could easily mislead NN to misclassify.
A. Generalization Accuracy Under Practical Variations
To evaluate the generalization improvement of the REIN
algorithm, we compare the two models’ (the natural model and
the generalization-enhanced model) classification accuracies in
four scenarios of our RobuTS dataset: 1) rain variation; 2) fog
variation; 3) darkening effect; and 4) bokeh/motion blurring.
For each scenario, we test all 20 levels of variation intensity
from 0 → 1, and the final results are shown in Fig. 5. To better
visualize the improvement of our REIN algorithm, we use the
light blue line to show the absolute accuracy improvement
of our generalization-enhanced model over the natural model,
which is calculated by Accgeneral − Accnatural .
Results and Analysis: As Fig. 5 shows, our generalization-
enhanced model outperforms the natural model in all four
scenarios by average +15%–25% accuracy.
1) Rain Variation: Our model achieves higher accuracy
under all rain variation intensity settings (at most
+17%), as shown in Fig. 5(a). In detail, as we increase
the rain variation intensity (i.e., number of raindrops) in
test images, both models’ accuracies show degradation
but our robust model clearly outperforms the natural one
by large margins. Natural model’s accuracy drops from
95.8% to 45%, while our model’s accuracy only drops
from 94.4% to 62%, showing much more resistance to
the rain variations;
2) Fog Variation: As Fig. 5(b) shows, our model can
achieve at most +25% accuracy improvement than the
original model, indicating a large extent of general-
ization enhancement. Also, as the upward accuracy
improvement trend shows, our model may achieve even
higher accuracy gain if the fog intensity is further
Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
(c) (d)
increased, demonstrating much higher tolerance and
robustness than the natural model.
3) Darkening and Blurring: In all other test scenarios, our
generalization-enhanced model also consistently shows
better performance: achieving average +15%–23%
accuracy improvement, as shown in Fig. 5(c) and (d).
But different from fog variations, the accuracy gain in
these two scenarios seems to saturate when achieving the
highest variation intensity. We hypothesis this is because
the highest-intensity variation in these cases has affected
the original image appearance too much, which signif-
icantly hinders the original NN classification process,
e.g., the accuracy of 20%–40%.
In such cases, our robust training cannot provide further
performance gain since the image content has been modified
too much to recognize the type of the traffic sign.
Overall, our REIN robust training algorithm is shown to
help the model to achieve consistently better performance in
all tested scenarios. Also, it is important to note that the whole
REIN training algorithm requires no extra data, i.e., no data
in these tested scenarios are used during the training pro-
cess. Therefore, the generalization-enhancement brought by
our training method is indeed model intrinsic and can even
potentially generalize to more scenarios than these tested ones.
B. Extreme Corner Case Evaluation: Adversarial Noises
Recently, adversarial noises have been shown to influence
the traffic sign classification system in real world [29], which
can be considered as some extreme corner cases of gener-
alization testing [30], [31], as shown in Fig. 6. To evaluate
our algorithm’s effectiveness in such cases, in this part, we
use a recently proposed adversarial attack algorithm to gener-
ate different intensities of adversarial noises and evaluate our
models’ performance under such variations as before.
1) Adversarial Variation Generation Mechanism:
Adversarial variation generation includes a family of attacking
algorithms, e.g., the C&W attack [32], which could mislead
NN by using a very small variation. To be general, we test
two state-of-the-art attacking algorithms: 1) fast gradient sign
method (FGSM) and 2) basic iterative method (BIM) [33].
YU et al.: REIN RobuTS: ROBUST DNN-BASED IMAGE RECOGNITION IN AUTONOMOUS DRIVING SYSTEMS
(a) (b)
Fig. 7. Classification accuracy in adversarial corner cases. (a) FGSM attack
model. (b) BIM attack model.
Fig. 8. Gradients comparison: our proposed training method could effec-
tively regulate gradients to a small range, thus significantly improving model’s
generalization capability.
Specifically, the FGSM attack model is defined as
 
∂Lossθ (x)
Xadv = Xorg + × Sign (15)
∂x
where Lossθ (x) denotes the C&W loss [32] in our experiment,
and ∂Lossθ (x)/∂x is the gradients of the loss with respect to
the input image itself. The Sign() function will return the sign
matrix of the input matrix. And here controls the variation
intensity (attack strength). Based on FGSM, BIM iteratively
calculate the above equation and clip the perturbation to the
given range (0 ∼ ).
As shown in Fig. 6, the original images and adversarial
attacked images by FGSM and BIM are shown with their clas-
sification results. With some small or even indistinguishable
distortions, these adversarial images successfully mislead NN
to misclassify. Thus, these small distortions found by attack-
ing algorithms could be considered as the worst but most
influential variations. Therefore, we use these attack models
to evaluate our generalization-enhanced training algorithm as
extreme corner cases.
2) Generalization Under Extreme Corner Cases: We use
the attacking models in (15) and the GTSRB test set to gener-
ate new testing images with adversarial variations against both
the natural model and our generalization-enhanced model. As
before, we use different to control the attacking strength, i.e.,
variation intensity. The tested models are the natural model and
the generalization-enhanced model trained by REIN. The final
testing results are shown in Fig. 7.
Result and Analysis: As Fig. 7 shows, the adversarial noises
affect the natural model’s performance much more seriously
than the four practical variations we tested before. Even though
Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
1267
the adversarial image with the highest intensity is still rather
clear to human (Fig. 6), they can cause the natural model’s
accuracy drop to 0%–15%. Even with half intensity, e.g.,
under the BIM attack = 0.4 − 0.5, the natural model’s
accuracy has already dropped to −5%, which is nearly ran-
dom guessing. In contrast, our generalization-enhanced model
achieves much higher performance, i.e., 40%–50% accuracy.
For the final results, our generalization-enhanced model out-
performs natural model by at most +30%–40% accuracy in
both attacking scenarios. Under the worst attacking cases (the
highest attacking strength), the REIN algorithm could also pro-
vide +23%–25% accuracy improvement than natural training,
demonstrating its effectiveness at adverse scenarios.
Overall, under adverse conditions (including bad weather
and even adversarial corner cases), our REIN algorithm could
grant the model nonnegligible generalization capability with
high accuracy improvement. In the next part, we analyze the
model’s training gradients and the Jacobian matrix to demon-
strate the reasons why our REIN algorithm can help the model
to achieve such better performance than natural training.
C. Generalization Improvement Analysis and Discussion
1) Gradient Curve During Training Process: Fig. 8 shows
the curve of gradients’ l2 norm in the natural training method
and our proposed REIN training method. In the natural training
process, the gradients keep increasing, and gradients’ l2 norm
finally reaches 117.30. In contrast, in our proposed training
method, gradients’ l2 norm is constrained to a much smaller
range. The final value of ours is 0.100, which is roughly
×1100 times less than the natural training method, thanks
to our gradient regularization loss design. According to our
generalization theory in Section III, the gradient magnitude is
inversely correlated to the generalization ability, i.e., the smaller
the gradient is, the more robust the model will be to practical
variations. Therefore, it is thus reasonable that our model shows
better generalization ability than the natural model, since our
model’s average gradient magnitude is much smaller.
2) Jacobian Matrix Interpretability: Besides the gradient
theory, we also use visualization techniques to visualize the
Jacobian matrix of both models. The Jacobian matrix of the
NN is a gradient matrix with respect to the input image, which
can evaluate every pixel’s contribution to the final prediction
results. Therefore, it can be used to interpret which pixels
are considered as the most important pixels to make the final
decision by the NN.
In Fig. 9, we visualize some images’ Jacobian matri-
ces using the natural model and our generalization-enhanced
model. As shown in Fig. 9(a) and (c), the naturally trained
model cannot effectively capture the main feature as its
Jacobian matrix visualization results are totally meaningless.
This implies the final decision making of the natural model is
averagely relying on the nonstructural pixels wide-spreading
the whole image. As a result, when practical variations occur,
the classification results can be easily influenced.
In contrast, our robust model could successfully capture
the major feature of the image content [as shown by the
dashed line in Fig. 9(b)]. This is because we set the gradient-
norm regularization during training. Therefore, the model is
enforced to avoid the wide-spreading gradient pattern but
1268 IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS, VOL. 40, NO. 6, JUNE 2021
(a)
(b)
(c)
Fig. 9. Jacobian matrix visualization: robust model focuses more on the main
pattern of the input image, and thus have better resistance against small varia-
tions in images. (a) Original image. (b) Jacob-Mat in our model. (c) Jacob-Mat
in the natural model.
focuses on only small-amount but major features to make
precise prediction (thus incurring slightly accuracy drop than
natural model). But after such a training process, the model
can automatically learn to extract the most distinguished fea-
tures of different traffic signs. These major features (e.g., the
red triangle edge of Yield sign) are hand-designed to have
higher contrast with backgrounds and are not easily affected by
weather variations. Thus, our generalization-enhanced model
is more capable of resisting variations than the natural model.
3) Algorithm Overhead Analysis: We evaluate the running
overhead of the REIN gradient regularized training method.
Here we consider the wall-clock time. We evaluate the aver-
age training time for 1k training iterations for REIN and the
natural training method. Averagely, our per-iteration training
time is 2.1 times than the natural training due to the double-
backpropagation overhead. Since the training stage can be
conducted offline and on server-level GPU, we believe the
time overhead of REIN training is acceptable. For example,
the whole 50k iterations to complete the REIN training only
takes 2.5 h on Titan V, which is quite normal for NN training.
But it in turn brings +15%–25% accuracy improvement under
various adverse conditions, and avoids the cost of collecting
the scenario-specific data, which can be much larger than the
training cost on GPUs. Considering the fact that autonomous
driving is security critical, and data collecting efforts by on-
road driving can be huge, we believe the offline training
overhead of the REIN algorithm is negligible compared to
the cost of that.
VII. E XPERIMENTS AND E VALUATION FOR Self-Teaching:
S ELF -T EACHING W ITH U NLABELED DATA
Experiment Setup: We adopt a stronger model VGG16 to
evaluate ST algorithm’s performance. The source dataset is a
clean GTSRB dataset as in the previous setting. But different
from the previous setting without extra data, in the ST algorithm,
we assume training images in the RobuTS dataset are avail-
able while their labels remain unavailable. The ST algorithm
introduces these extra unlabeled images with variations into
the training process by predicting pseudo-labels on them. The
aforementioned optimizations like imbalanced sampling and
curriculum learning, etc., are also used during ST iterations.
Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
As for the baseline, it is using the same VGG16 structure but
trained with natural training method on the source dataset since
there is no way to use the unlabeled data in natural training.
The models are then named the natural model and the ST
model, which can both achieve 98.5% accuracy on the clean
GTSRB test set due to the stronger VGG model structure. Then
we evaluated the models on the RobuTS test sets including
all four scenarios and variation intensities. Under four practi-
cal varied scenarios, we will show that our ST model could
achieve about +16%–30% accuracy improvement than the
natural model. Then, each ST optimization technique will also
be evaluated by ablation study to demonstrate their necessity.
A. Generalization Accuracy Under Practical Variations
We first evaluate the generalization enhancement of our ST
algorithm. As before, we compare the natural model’s and our
ST model’s accuracies under all tested scenarios. The over-
all results are shown in Fig. 10. The light blue line shows
the accuracy improvement of our ST model than the natural
model, i.e., Accsteaching − Accnatural .
Results and Analysis: With the stronger VGG model struc-
ture, our ST model still consistently outperforms the natural
model in all four scenarios by averagely +16%–30% accuracy,
as shown in Fig. 10.
1) Rain Variation: For the full-spectrum comparison in the
rain scenario, our ST model achieves at most +22%
accuracy improvement than the baseline model. In detail,
the baseline normal model’s accuracy drops from 98.5%
to 39.1%. In contrast, our ST model still maintains
nearly 60% accuracy at the highest intensity of rain
variation.
2) Fog Variation: Our ST model achieves a similar
performance gain (at most +19%) in the fog scenario.
Also, with small-intensity fog variations (e.g., 0–0.5
intensity level), the ST model could even maintain nearly
no accuracy drop, while the natural model already suf-
fers from −10% accuracy drop, which demonstrates the
effectiveness of ST with pseudo-labels.
3) Darkening and Blurring: Within darkening and blurring
scenarios, the ST model outperforms the natural model
baseline by at most +16%–30% accuracy improvement.
Notice that, ST seems to be most effective under the
blurring scenario: the ST model achieves over 80%
accuracy under the highest blurring intensity while the
natural model’s accuracy already drops to around 50%.
Meanwhile, the trend of accuracy improvement is consis-
tently upward, implying that the ST may achieve even higher
accuracy gain with higher blurring intensities.
As the results show, ST grants the model with higher gen-
eralization capability than natural training under most adverse
scenarios by utilizing the unlabeled images.
B. Ablation Study for Design Components
1) Improvement of Curriculum Learning Optimization: To
evaluate the effectiveness of curriculum optimization, we con-
duct an ablation study on the rainy scenario. The results are
shown in Fig. 11, where the yellow and blue lines show the
ST models’ accuracy improvement on top of the baseline (w/
YU et al.: REIN RobuTS: ROBUST DNN-BASED IMAGE RECOGNITION IN AUTONOMOUS DRIVING SYSTEMS 1269

(a) (b) (c) (d)

Fig. 10. ST evaluation. During testing with four different kinds of practical variations on traffic sign images, our ST model consistently outperforms natural
model by large margins of +16%–30% at the highest variation intensity. (a) Rain variation. (b) Fog variation. (c) Darkening effect. (d) Bokeh/motion blur.

Fig. 11. Ablation study for curriculum optimization in ST. As the Fig. 12. Ablation study for imbalanced sampling optimization in ST. As
result shows, there is a 10% accuracy drop without curriculum optimization the result shows, there is a 8% accuracy drop without imbalanced sampling
during ST. during ST.

and w/o curriculum learning). Clearly, the ST with curriculum
optimization (yellow line) outperforms the naive version (blue
line) by at most +10% accuracy, demonstrating the necessity
of curriculum optimization.
The reasons of performance difference are as follows: For
ST without curriculum learning, we directly pseudo-label all
the unlabeled data and combine them into the training dataset.
These data contains images with high-intensity rain variations,
and thus their corresponding labeling accuracy at such rain
intensity level is only around 30%–40%. As a result, these bad
pseudo-labels greatly hinder the performance improvement of
ST. In contrast, ST with curriculum learning can gradually
involve the data following an easy-to-hard way. Therefore, the
ST model can learn to predict these images with variations more
and more accurately, and thus achieving better performance.
2) Improvement of Imbalanced Sampling Optimization:
We conduct similar ablation study for imbalanced sampling
optimization, and the results are shown in Fig. 12. As the
results show, the imbalanced sampling also provides with +8%
accuracy improvement than the naive version.
Specifically, the imbalanced sampling is implemented as fol-
lows. Before combining the labeled and unlabeled data, we
control their composition ratio in the training dataset, e.g.,
2:1 (real-labeled data: pseudo-labeled data), as more clean
data with accurate labels are needed to stabilize the gradi-
ents of each mini-batch. Also for all ST experiments, we use
a progressive confidence thresholding strategy to control the
pseudo-label quality, i.e., decreasing the thresholds from 0.9
to 0.7 during the process of ST, which shows certain better
performance (+2%–3%) than the constant thresholding.
3) Self-Teaching Algorithm Overhead Analysis: The ST
overhead lies in the extra efforts of the model training on the
pseudo-labeled data. As we adopt the imbalanced sampling
optimization, the sampling ratio of labeled data and pseudo-
labeled data also affects the training overhead. In our experi-
ments, we adopt the sampling ratio of 2:1 between labeled and
unlabeled data in each iteration. Therefore, the per-epoch train-
ing efforts are around three times than the default one. Since
the model training can be mostly done offline, we consider
such overhead is acceptable in exchange for the classification
accuracy improvement.
C. Detection Enhancement Under Practical Variations
The ST method can also improve the performance of detection
tasks in autonomous driving. We apply our method on multiclass
object detection to demonstrate our performance enhancement
on two widely used detection datasets: 1) Cityscapes [39] and
2) Foggy-Cityscapes [40]. As the name shows, the Cityscapes
dataset contains images of street scenes and includes eight
detection classes, such as Pedestrian, Rider, Car, etc. The Foggy-
Cityscapes dataset includes the similar street scene images but
with certain fog variations.
For implementation, we build our algorithm on top
of cyclegan for style translation [36], and then use the
labeled Cityscapes and unlabeled Foggy-Cityscapes raw
images as training data for ST. The test data is from the

Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
1270 IEEE TRANSACTIONS ON COMPUTER-AIDED DESIGN OF INTEGRATED CIRCUITS AND SYSTEMS, VOL. 40, NO. 6, JUNE 2021
TABLE I
D ETECTION P ERFORMANCE E NHANCEMENT ON F OGGY-C ITYSCAPES DATASET. I NPUT IMAGES A RE R ESIZED W ITH 512 OR 600 P IXELS AS THE
S HORTER S IDE FOR FAIR C OMPARISONS W ITH D IFFERENT S TATE - OF - THE -A RT W ORKS
Foggy-Cityscapes testset for performance evaluation in the
adverse foggy condition. We use the faster-rcnn detector [41]
and the same input size settings with previous works [34],
[35], [37], [38]. For the performance evaluation, we report the
mAP of all classes following the settings in the aforemen-
tioned previous works for fair performance comparison. The
oracle performance denotes the model’s mAP trained on fully
annotated foggy-cityscapes train set, which can be regarded as
the upper bound performance.
As Table I shows, our ST method improves the base-
line detector’s performance by +10.1 mAP in 512 × 1024
resolution. Compared with previous state-of-the-art works,
our method also achieves better detection performance, e.g.,
+2.0 mAP and +2.2 mAP than [36] and [38] in 512 × 1024
and 600 × 1200 resolutions.
Overall, we show that our ST algorithm could bring
+16%–30% accuracy improvement for classification tasks and
+10.1 mAP for detection tasks in adverse conditions. In prac-
tice, the requirement of unlabeled data is also easy to fulfill
by safe data sharing policy without compromising user pri-
vacy [25]. Therefore, we believe the ST algorithm has its great
potential in enhancing NN model’s generalization capability in
autonomous driving systems.
VIII. C ONCLUSION
In this work, we first build a comprehensive RobuTS dataset
including traffic sign images in four adverse weather condi-
tions, e.g., rainy, foggy, etc. Based on that, we benchmark
NN-based classifiers and demonstrate their low generaliza-
tion ability under practical variations. Then, we propose two
novel robust training schemes REIN and Self-Training target-
ing at boosting model generalization ability in two scenarios:
1) without extra training data and 2) with unlabeled data in
adverse conditions. Experiments show that our proposed meth-
ods could greatly improve model’s intrinsic generalization in
both classification and detection tasks.
R EFERENCES
[1] D. Feng, L. Rosenbaum, and K. Dietmayer, “Towards safe autonomous
driving: Capture uncertainty in the deep neural network for Lidar 3D
vehicle detection,” in Proc. 21st Int. Conf. Intell. Transp. Syst. (ITSC),
2018, pp. 3266–3273.
Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
[2] B. Wu, A. Wan, F. Iandola, P. H. Jin, and K. Keutzer, “Squeezedet:
Unified, small, low power fully convolutional neural networks for real-
time object detection for autonomous driving,” in Proc. IEEE Conf.
Comput. Vis. Pattern Recognit. Workshops, 2017, pp. 446–454.
[3] Z. Chen and Z. Chen, “RBNet: A deep neural network for unified road
and road boundary detection,” in Proc. Int. Conf. Neural Inf. Process.,
2017, pp. 677–687.
[4] D. Hospach, S. Mueller, W. Rosenstiel, and O. Bringmann, “Simulation
of falling rain for robustness testing of video-based surround sensing
systems,” in Proc. Design Autom. Test Eur. Conf. Exhibit. (DATE), 2016,
pp. 233–236.
[5] R. Gallen, A. Cord, N. Hautiére, É. Dumont, and D. Aubert, “Nighttime
visibility analysis and estimation method in the presence of dense fog,”
IEEE Trans. Intell. Transp. Syst., vol. 16, no. 1, pp. 310–320, Feb. 2015.
[6] H. H. Aghdam and E. J. Heravi, Guide to Convolutional Neural
Networks: A Practical Application to Traffic-Sign Detection and
Classification. Cham, Switzerland: Springer, 2017.
[7] Y. Tian, K. Pei, S. Jana, and B. Ray “DeepTest: Automated test-
ing of deep-neural-network-driven autonomous cars,” 2017. [Online].
Available: arXiv:1708.08559.
[8] A. Lubben. (2018). Self Driving Uber Killed a Pedestrian as Human
Safety Driver Watched. [Online]. Available: https://www.vice.com/en-
us/article/kzxq3y
[9] J. Horwitz and H. Timmons. (2019). There Are Some Scary Similarities
Between Tesla’s Deadly Crashes Linked to Autopilot. [Online].
Available: https://qz.com/783009/
[10] J. Green. (2018). Tesla: Autopilot Was on During Deadly Mountain View
Crash. [Online]. Available: https://www.mercurynews.com/2018/03/30
[11] K. Lim, Y. Hong, Y. Choi, and H. Byun, “Real-time traffic sign recog-
nition based on a general purpose GPU and deep-learning,” PLoS ONE,
vol. 12, no. 3, 2017, Art. no. e0173317.
[12] M. Nentwig and M. Stamminger, “Hardware-in-the-loop testing of com-
puter vision based driver assistance systems,” in Proc. Intell. Veh. Symp.
(IV), 2011, pp. 339–344.
[13] J.-H. Kim, W.-D. Jang, J.-Y. Sim, and C.-S. Kim, “Optimized contrast
enhancement for real-time image and video dehazing,” J. Vis. Commun.
Image Represent., vol. 24, no. 3, pp. 410–425, 2013.
[14] P. Dollár, C. Wojek, B. Schiele, and P. Perona, “Pedestrian detection: A
benchmark,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2009,
pp. 304–311.
[15] C. Lee and J.-H. Moon, “Robust lane detection and tracking for real-
time applications,” IEEE Trans. Intell. Transp. Syst., vol. 19, no. 12,
pp. 4043–4048, Dec. 2018.
[16] W. Liu, S. Liao, W. Ren, W. Hu, and Y. Yu, “High-level semantic feature
detection: A new perspective for pedestrian detection,” in Proc. IEEE
Conf. Comput. Vis. Pattern Recognit., 2019, pp. 5187–5196.
[17] Y. Hou, Z. Ma, C. Liu, and C. C. Loy, “Learning lightweight lane
detection CNNS by self attention distillation,” in Proc. IEEE Int. Conf.
Comput. Vis., 2019, pp. 1013–1021.
[18] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet:
A large-scale hierarchical image database,” in Proc. IEEE Conf. Comput.
Vis. Pattern Recognit. (CVPR), 2009, pp. 248–255.
YU et al.: REIN RobuTS: ROBUST DNN-BASED IMAGE RECOGNITION IN AUTONOMOUS DRIVING SYSTEMS
[19] P. Sermanet and Y. LeCun, “Traffic sign recognition with multi-scale
convolutional networks,” in Proc. Int. Joint Conf. Neural Netw. (IJCNN),
2011, pp. 2809–2813.
[20] J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel, “The German traffic
sign recognition benchmark: A multi-class classification competition,”
in Proc. IEEE Int. Joint Conf. Neural Netw., 2011, pp. 1453–1460.
[21] M.-Y. Fu and Y.-S. Huang, “A survey of traffic sign recognition,”
in Proc. Int. Conf. Wavelet Anal. Pattern Recognit. (ICWAPR), 2010,
pp. 119–124.
[22] (2017). Udacity Self-Driving-Car Challenge. [Online]. Available:
https://github.com/udacity/self-driving-car/tree/master/
[23] J. Wu, C. Zheng, X. Hu, Y. Wang, and L. Zhang, “Realistic rendering
of bokeh effect based on optical aberrations,” Vis. Comput., vol. 26,
nos. 6–8, pp. 555–563, 2010.
[24] H. Drucker and Y. Le Cun, “Double backpropagation increasing gener-
alization performance,” in Proc. Int. Joint Conf. Neural Netw. (IJCNN),
vol. 2, 1991, pp. 145–150.
[25] Tesla. (2019). Tesla Data Sharing Privacy Policy. [Online]. Available:
https://www.tesla.com/about/legal
[26] F. Yu et al., “Unsupervised domain adaptation for object detection
via cross-domain semi-supervised learning,” 2019. [Online]. Available:
arXiv:1911.07158.
[27] X. Zhu and A. B. Goldberg, “Introduction to semi-supervised learning,”
in Synthesis Lectures on Artificial Intelligence and Machine Learning,
vol. 3. San Rafael, CA, USA: Morgan & Claypool, 2009, pp. 1–130.
[28] M. Abadi et al., “TensorFlow: Large-scale machine learning
on heterogeneous distributed systems,” 2016. [Online]. Available:
arXiv:1603.04467.
[29] I. Evtimov et al., “Robust physical-world attacks on deep learning
models,” 2017. [Online]. Available: arXiv:1707.08945.
[30] F. Yu, Z. Qin, C. Liu, L. Zhao, Y. Wang, and X. Chen, “Interpreting
and evaluating neural network robustness,” in Proc. 28th Int. Joint Conf.
Artif. Intell. (IJCAI), 2019, pp. 4199–4205.
[31] F. Yu, C. Liu, Y. Wang, L. Zhao, and X. Chen, “Interpreting adversarial
robustness: A view from decision surface in input space,” 2018. [Online].
Available: arXiv:1810.00144.
[32] N. Carlini and D. Wagner, “Towards evaluating the robustness of neural
networks,” 2016. [Online]. Available: arXiv:1608.04644.
[33] A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the
physical world,” 2016. [Online]. Available: arXiv:1607.02533.
[34] Y. Chen, W. Li, C. Sakaridis, D. Dai, and L. Van Gool, “Domain adaptive
faster R-CNN for object detection in the wild,” in Proc. IEEE Conf.
Comput. Vis. Pattern Recognit., 2018, pp. 3339–3348.
[35] X. Zhu, J. Pang, C. Yang, J. Shi, and D. Lin, “Adapting object detectors
via selective cross-domain alignment,” in Proc. IEEE Conf. Comput. Vis.
Pattern Recognit., 2019, pp. 687–696.
[36] J.-Y. Zhu, T. Park, P. Isola, and A. A. Efros, “Unpaired image-to-image
translation using cycle-consistent adversarial networks,” in Proc. IEEE
Int. Conf. Comput. Vis., 2017, pp. 2242–2251.
[37] K. Saito, Y. Ushiku, T. Harada, and K. Saenko, “Strong-weak distri-
bution alignment for adaptive object detection,” in Proc. IEEE Conf.
Comput. Vis. Pattern Recognit., 2019, pp. 6956–6965.
[38] R. Xie, F. Yu, J. Wang, Y. Wang, and L. Zhang, “Multi-level domain
adaptive learning for cross-domain detection,” in Proc. IEEE Int. Conf.
Comput. Vis. Workshops, 2019, pp. 3213–3219.
[39] M. Cordts et al., “The cityscapes dataset for semantic urban scene under-
standing,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2016,
pp. 3213–3223.
[40] C. Sakaridis, D. Dai, and L. Van Gool, “Semantic foggy scene under-
standing with synthetic data,” Int. J. Comput. Vis., vol. 126, no. 9,
pp. 973–992, 2018.
[41] S. Ren, K. He, R. Girshick, and J. Sun, “Faster R-CNN: Towards real-
time object detection with region proposal networks,” in Proc. Adv.
Neural Inf. Process. Syst., 2015, pp. 91–99.
Fuxun Yu received the B.S. degree from the Harbin
Institute of Technology, Harbin, China, in 2017.
He is currently pursuing the Ph.D. degree with the
Department of Electrical and Computer Engineering,
George Mason University, Fairfax, VA, USA, under
the supervision of Prof. X. Chen.
His current research interests include deep
learning robustness, high-performance deep neural
network computing and optimization, interpretabil-
ity, and explainability of deep learning.
Authorized licensed use limited to: SASTRA. Downloaded on March 21,2023 at 06:35:19 UTC from IEEE Xplore. Restrictions apply.
1271
Zhuwei Qin received the B.S. degree from the
Tianjin University of Science and Technology,
Tianjin, China, in 2014, and the M.S. degree
from Oregon State University, Corvallis, OR, USA,
in 2017. He is currently pursuing the Ph.D.
degree with the ECE Department, George Mason
University, Fairfax, VA, USA, under the supervision
of Prof. X. Chen.
His current research directions include deep neu-
ral network compression, and interpretable deep
neural network for mobile applications.
Chenchen Liu received the M.S. degree from
Peking University, Beijing, China, in 2013, and the
Ph.D. degree from the ECE Department, University
of Pittsburgh, Pittsburgh, PA, USA, in 2017.
In 2017, she joined the Department of Electrical
and Computer Engineering, Clarkson University,
Potsdam, NY, USA. She is currently an Assistant
Professor with the Department of Computer Science
and Electrical Engineering, University of Maryland
at Baltimore County, Baltimore, MD, USA. Her
current researches include brain-inspired comput-
ing system and security, machine learning, integrated circuits design, and
emerging nonvolatile memory technologies.
Di Wang received the B.E. degree in computer
science and technology from Zhejiang University,
Hangzhou, China, in 2005, the M.S. degree in
computer systems engineering from the Technical
University of Denmark, Lyngby, Denmark, in 2008,
and the Ph.D. degree in computer science and engi-
neering from Pennsylvania State University, State
College, PA, USA, in 2014.
He is currently a Principal Research Lead with
Microsoft, Redmond, WA, USA. He has authored
more than 40 peer-reviewed papers. His research
spans the areas of artificial intelligence, computer systems, computer archi-
tecture, and energy-efficient system design and management.
Dr. Wang received five best paper awards and two best paper nominations.
Xiang Chen (Member, IEEE) received the M.S. and
Ph.D. degrees from the ECE Department, University
of Pittsburgh, Pittsburgh, PA, USA, in 2012 and
2016, respectively.
He is currently an Assistant Professor with the
Department of the Computer Engineering, George
Mason University, Fairfax, VA, USA, where he is
the Founder of the Intelligence Fusion Laboratory.
He also stays in close cooperation with not only
academic society, such as Duke University, Durham,
NC, USA; University of California at Santa Barbara,
Santa Barbara, CA, USA; University of Pittsburgh, Pittsburgh, PA, USA;
Syracuse University, Syracuse, NY, USA; Tsinghua University, Beijing, China;
Hong Kong University of Science and Technology, Hong Kong; and City
University of Hong Kong, Hong Kong, but also industries, such as the research
labs of HP, Palo Alto, CA, USA; Samsung, Suwon, South Korea; MSRA,
Beijing, China; Marvell, Hamilton, Bermuda; Amazon, Seattle, WA, USA; and
Apple, Cupertino, CA, USA. In the past years of research, he has published
more than 30 papers in the top international conferences and journals and
received many best paper nominations and other awards. His research interests
are in the low-power mobile system, high-performance mobile computing,
machine learning, and secure computing system.