RAIN: RegulArization on Input and Network for Black-Box Domain Adaptation

1 Introduction

Domain adaptation [Wang and Deng, 2018] is proposed to transfer knowledge from the labeled training data that form the source domain to the unlabeled test data that form the target domain. Owing to the concerns about data privacy and security, a new setting -Source-Free domain adaptation [Liang et al., 2020]- emerges, where source data are completely unavailable when adapting to the target. Even so, there are still potential risks if the source models are visible. Some works like dataset distillation [Wang et al., 2018] and DeepInversion [Yin et al., 2020] may recover data from the model through adversarial attacks. In such a case, Black-Box domain adaptation [Zhang et al., 2021] is proposed to consider the source models are completely unseen and only model outputs are accessible for target adaptation, which is a more strict version of Source-Free domain adaptation.

Due to the limited access to the source model, the only way we obtain source information is by doing knowledge distilling between the source model and the target model. In the original Source-Free setting, we can alleviate domain shifts by updating the source model gradually, keeping the transferrable parameters while replacing the untransferrable ones. However, in the Black-box scenario, only the source model's outputs are exposed, i.e., the source information cannot be disentangled as target-relevant and target-irrelevant parts as Source-Free does. The overfitting on the source domain in Black-Box is much stronger than that in Source-free, which greatly undermines the target models' performance. [Liang et al., 2022] observes this problem and uses conventional MixUp [Zhang et al., 2018] as regularization for better generalization. However, there exist problems with regularization methods like MixUp or CutMix [Yun et al., 2019] because they are conducted on both input and label levels. In the target adaptation process, we do not have accurate labels but the pseudo labels as substitutes and the linear behaviors learned from these noisy pseudo-labels due to domain shifts could have negative impacts on the generalization and degrade the model's performance (details in Table 4).

Based on the discussions above, we develop a new and effective data augmentation method for domain adaptation named Phase MixUp, which regularizes ML model training only from the input aspect. Apart from inhibiting potential noises from pseudo-labels, our Phase MixUp can highlight task-relevant objects and avoid negative impacts from background information as well. Conventional MixUp directly blends one image's pixels into another image [Wu et al., 2020; Liang et al., 2022]. But this kind of combination is too simple to highlight the objects that we want to classify, especially when the image owns complex background and style information. For example, the top of Fig. 1 shows the conventional MixUp between the "television" image and the "hammer" image. The "hammer" image has a very strong dark shadow that outweighs another object "television" when µ = 0.50. Besides, when µ = 0.75, the "television" is completely unseen. In such cases, background elements like dark shadow will have a negative impact on conventional MixUp as they distract the attention of core objects and the model tends to connect the "hammer" with the shadow instead. Frequency decomposition proves to be a useful tool to disentangle object information and background information from an image [Yang and Soatto, 2020; Liu et al., 2021], since amplitude spectra contain most background information, while phase spectra are related to object information. Therefore, we propose Phase MixUp (Fig. 2b) to capture the key objects and reduce background interference at the same time, as the bottom of Fig. 1 shows. By mixing their phase spectra, we can focus more on the two core objects "television" and "hammer" and weaken background information like the shadow. Even under a more extreme case like µ = 0.75, the "television" still exists in the mixed image of Phase MixUp. The augmented image will attend further training to enhance the target model's class consistency.

What's more, despite the fact that input- and label-level regularizations have received enough attention in domain adaptation, regularization from the network aspect is overlooked. Specifically, in the Black-Box setting, only the source model's outputs are accessible, which leads to more severe overfitting of target networks on source information. Because target networks have to learn from the outputs produced by source models without detailed calibrations on network weights as the Source-Free setting does. Therefore, a network-level regularization technique on target networks is necessary. To this end, we propose a novel method for domain adaptation called Subnetwork Distillation, which aims to regularize the full target network with the help of its subnetwork and calibrate the full target networks gradually. We slim the widths of the target network to get its subnetwork, which has a smaller scale than the full network, hence less likely overfitting to the source domain. By transferring knowledge from the target subnetwork to the full target network, the original full network captures diverse representations from the target domain with a better generalization ability.

Our contributions are summarized in three aspects:

• We propose Phase MixUp as a new input-level regularization scheme that helps the model enhance class consistency
• with more task-relevant object information, thus obtaining more robust representations for the target domain.
• We introduce a novel network-level regularization technique called Subnetwork Distillation that assists the target model to learn diverse representations and transfers knowledge from the model's partial structures to avoid overfitting on Black-Box source models.
• We conduct extensive experimental results on several benchmark datasets with both Single-Source and MultiSource settings, showing that our approach achieves stateof-the-art performance compared with the latest methods for Black-Box domain adaptation.

2 RelatedWork

Domain Adaptation. Metric-based and GAN-based approaches are the two major routes in single-source domain adaptation. The metric-based methods measure the discrepancy between the source and target domain explicitly. [Long et al., 2015] uses maximum mean discrepancy, while [Tzeng et al., 2014] applies deep domain confusion. Recent work like [Deng et al., 2021] jointly makes clustering and discrimination for alignment together with contrastive learning. The GAN-based methods originate from [Goodfellow et al., 2014] and build a min-max game for two players related to the source and target domains. [Ganin and Lempitsky, 2015] adopts domain to confuse the two players, while [Saito et al., 2018] uses classifier discrepancy as the objective, and [Tang et al., 2020] reveals that discriminative clustering on target will benefit the adaptation. However, the general domain adaptation setting needs access to source data, which raises concerns about data privacy and security, so SourceFree adaptation is proposed.

Source-Free Domain Adaptation. Based on the work of [Li et al., 2020; Liang et al., 2020], Source-Free has become the mainstream paradigm for alleviating concerns about data privacy and security in domain adaptation. There are two technique routes under the source-free setting: self-supervision and virtual source transfer. For the selfsupervised methods, [Liang et al., 2020] is the most representative one, which introduces information maximization to assist adaptation. [Xia et al., 2021] treats the problem from a discriminative perspective and adds a specific representation learning module to help the generalization, and [Chen et al., 2022] proposes the online pseudo label refinement. As for virtual source methods, most of them build GANs to generate virtual source data. [Kurmi et al., 2021] uses conditional GAN to generate new samples, while [Hou and Zheng, 2021] provides interesting visualizations for unseen knowledge and [Li et al., 2020] applies collaborative GAN to achieve better generations. But Source-Free is still at risk of data leakage due to adversarial attacks to visible model weights, and that leads to a more strict setting - Black-Box domain adaptation.

Black-Box Domain Adaptation is a subset problem of Source-Free domain adaptation and is also a very novel topic. It is more strict than Source-Free because the models trained on source will be put into a black box and only the outputs of these models can be used during model adaptation. [Zhang et al., 2021] first states this setting completely and emphasizes the purification of noisy labels in the adaptation. [Liang et al., 2022] introduces knowledge distillation to the blackbox problem, which largely improves the performance. All the details are the same as the Source-Free setting except that the source model strictly follows the Black-Box rule as its weights are completely invisible while outputs are accessible.

3 Methodology

Our proposed method RAIN tackles the Black-Box domain adaptation from the perspective of regularization (both inputlevel and network-level). The overall framework is presented in Fig. 2a. In the following subsections, we elaborate on the key components of the framework.

3.1 Preliminary

For a typical domain adaptation problem, we have a source domain dataset S = {(xsi , ys i )}ns i=1 with ns labeled samples. The target domain dataset T = {xti }nt i=1 includes nt unlabeled samples, which shares the same label space D = {1, 2, · · · ,K} with source but lie in different distributions, where K is the number of classes. The goal of domain adaptation is to seek the best target model ft with the help of source model as fs.

For the Black-Box paradigm, the learning starts with the supervised learning on source as Ls = -E(xsi ,ys i )∈S ∑k∈D ls i log fs(xsi ) with label smoothing [Muller et al., 2019]: ls i = α/K + (1 - α)ys i , where α is smoothing parameter empirically set to 0.1. Moreover, the source model's details are completely unseen except for the model's outputs. In this case, knowledge distillation [Hinton et al., 2015] is applied to transfer from source to target:

where DKL(·) denotes Kullback-Leibler (KL) Divergence and ˆ yt i is the pseudo-label. Now we explain how to obtain ˆ yt i . Assume that q = arg max fs(xti ), then we deduce the smooth pseudo label lt i = α′ /K + (1 - α′ )q, where α′ is smoothing parameter empirically set to 0.1. Based on this, the pseudo label ˆ yt i can be represented as ˆ yt i = ηlt i + (1 - η)ft(xti ), where η is a momentum hyperparameter set as 0.6.

3.2 Enhancing Input Regularization via Phase MixUp

Conventional MixUp is a very popular input- and label-level regularization technique in domain adaptation [Wu et al., 2020; Liang et al., 2022], whose goal is to enhance class-wise consistency and linear behavior, thus helping the model learn better representations on target domain. Nevertheless, there exist noises in the pseudo-labels applied to MixUp, which are harmful to the adaptation process, and that's why we propose an input-level (only) regularization method here. Next details of the proposed Phase MixUp process are presented. We begin by introducing the standard format of the Fourier transform. Assume a target sample xti ∈ RC×H×W , where C, H and W correspond to channel numbers, height and width. We transfer it from spatial space to frequency space and then decompose its frequency spectrum as amplitude and phase:

Here we ensure the one-to-one correspondence between channels of different spaces. Here xti is a spatial image representation based on image pixel (h,w), and F t i is a frequency image representation based on frequency spectrum unit (u, v). Ati is the amplitude spectrum and P t i is the phase spectrum of the target sample xti . According to [Yang and Soatto, 2020; Liu et al., 2021], the amplitude spectrum reflects the low-level distributions like the style, and the high-level semantics like object shape is stored in the phase spectrum. Since our task here is domain adaptation for object recognition, we hope the mixup procedure focuses more on the key objects rather than the background information. Hence, we interpolate between phase spectra as:

where P t j is the phase spectrum from a randomly-selected target sample xtj as F(xtj ) = Atj exp (P t j ), and µ is sampled from a Beta distribution as Beta(0.3, 0.3). After that, the Phase MixUp augmented sample produced by inverse Fourier Transform is:

The Phase MixUp procedure is depicted in Fig. 2b. After obtaining the synthesized sample, we can enhance class consistency by comparing the outputs of the original and synthesized samples. Here ℓ1-norm is utilized to compute the Phase MixUp loss as:

Phase MixUp is different from conventional MixUp. First, our Phase MixUp is conducted on the phase spectra related to core objects, not the whole image. Moreover, conventional MixUp operates on both input- and label-level, while Phase MixUp is an input-level augmentation.

3.3 Encouraging Network Regularization via Subnetwork Distillation

During the procedure of knowledge transfer from source models to target models with knowledge distillation (Eq. 1), overfitting on source information is an obvious side effect. Especially in the Black-Box setting, only the source model's outputs are visible while the source model's weights are completely unseen. In other words, the careful calibration of the target network's weights in the Source-Free setting cannot be achieved here. Hence, it is necessary to propose a specific network-based regularization method.To this end, we propose the Subnetwork Distillation approach to domain adaptation, which utilizes the self-knowledge transfer from the target subnetwork to the full target network with distinctive knowledge. We hope this structure can assist the model to obtain more target information from diverse representations far from the support of source, thus overcoming overfitting on source. We denote the full target network's weights as Wfull and the target subnetwork as Wsub. If the complete network can be represented as Wfull = W0:1, then by slimming the network width with a ratio α ∈ (0, 1], the subnetwork can be generated as Wsub = W0:α, i.e., a subnetwork with W0:α means selecting the first α × 100% weights of each layer of the full network. Therefore, the network's output with width α is denoted as ft(xti ;W0:α). The Subnetwork Distillation objective is defined as

After getting these outputs from the subnetwork with smaller widths, we compare them with the original network's outputs using Jensen-Shannon (JS) divergence, shown in Fig. 3. To prevent the adverse influence on the inference with original images and full networks, here we use the images operated after Phase MixUp, which can also add perturbations to the regularization for more robust representations.

Now we provide a theoretical analysis to illustrate why the JS divergence can benefit the adaptation process. Assume that Phase MixUp is a mapping function fPM : x → z, and the following neural network is fnetwork : z → y. Here we have three types of networks, the source network fs, the full target network ft, and the target subnetwork fsub. Besides, we make two assumptions that are intuitive to understand:

Assumption 1. Based on observed latent variables z and an empirical predictor ˆ p, - log ˆ p(y|z) can be bounded by C, which is a constant.

Assumption 2. The target subnetwork is superior to the source network on the target datasets. Mathematically,

What's more, there is a lemma that assists our main conclusion Theorem 1:

Lemma 1. The source loss and target loss are bounded by joint distributions and empirical predictions as:

On the basis of the proposed assumptions and lemma, we conclude the bound for the target loss as:

Theorem 1. The target loss can be bounded by source loss and the JS divergence between the outputs of the full target network and target subnetwork as:

DJS(pt(y, z)||psub(y, z)) corresponds to Eq. 6, which proves that the optimization of the JS divergence can benefit the adaptation process on the target domain.

There exist two extremes that hinder our goal. One is at the beginning of adaptation, when the subnetwork is very different from the full network, but it owns much greater errors than the full network, and the knowledge transfer is negative to the adaptation. The other is at the end of adaptation, subnetwork is very similar to the full network so that not enough knowledge can be transferred from the subnetwork to the full network. In such a case, the Subnetwork Distillation is meaningless. Provided that the gradient of the full network is gfull = ∂Lsd ∂Wfull , and the gradient of the subnetwork is gsub = ∂Lsd ∂Wsub , then we propose a weighted gradient discrepancy loss to balance this two extremes:

Here the left term is the weight and the right term is the cosine similarity between gsub and gfull. By minimizing the right term, the discrepancy between two gradients is enlarged, which provides a disturbance and guarantees that the full network and subnetwork learn divergent knowledge. The left term offers constraints on the gradient dissimilarity so that if the subnetwork doesn't learn distributions that are confident enough, a smaller weight will be assigned, and vice versa.

3.4 Overall Objectives

Based on the above discussion, we conclude the final objective for Black-Box domain adaptation:

where β, γ, and θ are the trade-off hyperparameters for corresponding loss functions.

4 Experiments

Datasets. We use four popular benchmark datasets for evaluation. Office-31 [Saenko et al., 2010] has three domains as Amazon, Webcam, and DSLR with 31 classes and 4,652 images. Image-CLEF [Long et al., 2017] is a relatively small dataset with three domains, and each domain includes 12 classes and 600 images. Office-Home [Venkateswara et al., 2017] is a medium-size dataset, containing four domains as Art, Clipart, Product, and Real World. Each domain includes 65 classes and the total number of images is 15,500. VisDA-C [Peng et al., 2017] is the most challenging dataset among the four, with 152,000 synthesized images serving as the source domain and 55,000 real images serving as the target domain, each with 12 classes.

Model Architecture. We adopt ResNet-50 [He et al., 2016] as the backbone for Office-31 and Office-Home, and ResNet101 for VisDA-C. To facilitate fair comparisons, we follow the protocols from DINE [Liang et al., 2022], replacing the last layer of the target network with a pipeline as a fullyconnected layer, batch normalization layer, fully-connected layer, and weight normalization layer. As for the pretrained source model, ResNet and Vision Transformer (ViT) [Dosovitskiy et al., 2020] are applied.

Implementation. We set the batch size to 64 and adopt SGD [Ruder, 2016] as the optimizer, with a momentum of 0.9 and a weight decay of 1e-3. For Office-31 and OfficeHome, the learning rate is set as 1e-3 for the convolutional layers and 1e-2 for the rest. For VisDA-C, we choose 1e-4 for the convolutional layers and 1e-3 for the rest. The learning rate scheduler is the same as [Liang et al., 2020], i.e., a polynomial annealing strategy. Label smoothing [Muller et al., 2019] is used on the leverage of source client, with 100 epochs for all the tasks. For the training procedure on target client, we train 30 epochs for all the tasks. In the evaluation stage, all results are obtained by averaging three random runs. For the hyper-parameters in Eq. 11, we set β = 1.2, γ = 0.6, and θ = 0.3. PyTorch [Paszke et al., 2019] is used for the implementation. For the proposed Subnetwork Distillation (Sec. 3.3), the subnetwork width is set as 0.84×.When it comes to inference, we only use the full target network. Training is conducted on an NVIDIA RTX A5000 GPU.

Baselines. Several state-of-the-art baselines are selected for comparison. For Single-Source adaptation, we compare our method with NLL-OT [YM. et al., 2020], NLL-KL [Zhang et al., 2021], HD-SHOT [Liang et al., 2020], SD-SHOT [Liang et al., 2020], DINE [Liang et al., 2022], and DINE-full [Liang et al., 2022]. For Multi-Source adaptation, we compare with SD-DECISION [Ahmed et al., 2021], DINE w/o Fine-Tune (FT) [Liang et al., 2022], DINE [Liang et al., 2022], and DINE-full [Liang et al., 2022].

4.1 Results

We compare our method (RAIN) with existing Single-Source and Multi-Source approaches, and the results are shown in Table 1 and Table 2 separately.

For Single-Source adaptation, our model achieves state-ofthe-art performances on average in three datasets. Compared with the second-best results, our method yields improvements of 1.8%/1.1% in Office-31, 2.4%/0.9% in Office-Home, and 5.4%/1.6% in VisDA-C. And in most tasks, our approach outperforms all the listed baselines. For Multi-Source adaptation, our model also obtains state-of-the-art results in three datasets, yielding average improvements of 1.4%/1.1% in Office-31, 1.3%/0.7% in Image-CLEF, and 1.4%/1.8% in Office-Home. Besides, in all the tasks of Multi-Source adaptation, RAIN outperforms all the listed baselines.

4.2 Analysis

Ablation Study. We study the contributions of three proposed losses in our approach and the results are shown in Table 3. Three representative tasks from different datasets are selected for both Single-Source and Multi-Source adaptation. Based on the three losses and their dependency (e.g., Lwg relies on the value of Lsd), six situations are listed. From Table 3, we observe that all the components play a role in improving the model's performance. Besides, it demonstrates that simply using Lsd cannot ensure the efficacy of the distillation from the subnetwork to full network, as the increases are all less than 1%. However, when Lsd works together with Lwg, the boost is significant enough as no less than 2.3% in all tasks here. This indicates that maintaining the gradient discrepancy of the full target network and target subnetwork is really important, as it ensures that the target subnetwork learns different knowledge, thus guaranteeing the distillation process in Lsd to be meaningful. As the proposed Phase MixUp can be considered as a general data augmentation scheme, we further validate its superiority by comparing it with the existing stateof-the-art augmentation methods including MixUp [Zhang et al., 2018], RandAugment [Shorten and Khoshgoftaar, 2019]

and CutMix [Yun et al., 2019]. All these techniques are combined with different Black-Box adaptation approaches. The comparison results of Single-Source and Multi-Source adaptation are listed in Table 4. It is evident that Phase MixUp consistently outperforms all the other three techniques, and it plays a positive role in all situations.

Parameter Study. There are three hyperparameters in our overall objective (Eqs. 11) as β, γ, and θ that weight the importance of Lpm, Lsr, and Lwg. We select the task Ar→Cl from Office-Home and conduct parameter analysis in Fig. 4a, Fig. 4b, and Fig. 4c. For β, we choose relatively large values with an interval of 0.3, while for γ and θ the values are smaller with an interval of 0.15 and 0.05 respectively. From this figure, we can observe that the best values for β are near 1.2 and 1.5. For γ, 0.60 to 0.75 is a suitable range, and 0.25 to 0.30 is ideal for θ. What's more, we can see that the model's performance remains stable and competitive in the range of values we tested. We also provide a detailed analysis of the subnetwork width in Subnetwork Distillation based on both SingleSource and Multi-Source settings with the tasks Ar→Rw and →A separately, as shown in Fig. 4d. We see that the best choice for the Single-Source task is between 0.84 and 0.88, while it is between 0.80 and 0.84 for the Multi-Source task. Our choice of using 0.84 is reasonable.

Qualitative Visualization. We use t-SNE [Van der Maaten and Hinton, 2008] to visualize the features produced by source-pretrained models (i.e. No-Adapt) and our models (i.e. Fully-Adapted), and the results are shown in Fig. 5, where the left part is about Single-Source and the right part is about Multi-Source. Fig. 5a and Fig. 5c are results before adaptation, while Fig. 5b and Fig. 5d are results after adaptation. All of these features are produced by Resnet-based source models and target models. From them, we can observe that after adaptation, the data points with varied colors (i.e., from different domains) formmultiple clear clusters and are no longer in chaos, which demonstrates the effectiveness of our proposed method RAIN.

5 Conclusion

In this paper, we propose a method named RegulArization on Input and Network (RAIN) for Black-Box domain adaptation. We propose a new data augmentation technique called Phase MixUp to regularize the data input, thus encouraging class consistency for better target representations. We also propose Subnetwork Distillation as a network-level regularization technique to transfer knowledge from the target subnetwork to the full target network, hence learning diverse target representations and calibrating the full network. Comprehensive experiments on several datasets testify RAIN's efficacy in both Single-Source and Multi-Source settings, together with detailed quantitative and qualitative analysis.