Abstract:Adversarial training is one of the main defenses against adversarial attacks. In this paper, we provide the first rigorous study on diagnosing elements of adversarial training, which reveals two intriguing properties. First, we study the role of normalization. Batch normalization (BN) is a crucial element for achieving state-of-the-art performance on many vision tasks, but we show it may prevent networks from obtaining strong robustness in adversarial training. One unexpected observation is that, for models trained with BN, simply removing clean images from training data largely boosts adversarial robustness, i.e., 18.3%. We relate this phenomenon to the hypothesis that clean images and adversarial images are drawn from two different domains. This two-domain hypothesis may explain the issue of BN when training with a mixture of clean and adversarial images, as estimating normalization statistics of this mixture distribution is challenging. Guided by this two-domain hypothesis, we show disentangling the mixture distribution for normalization, i.e., applying separate BNs to clean and adversarial images for statistics estimation, achieves much stronger robustness. Additionally, we find that enforcing BNs to behave consistently at training and testing can further enhance robustness. Second, we study the role of network capacity. We find our so-called "deep" networks are still shallow for the task of adversarial learning. Unlike traditional classification tasks where accuracy is only marginally improved by adding more layers to "deep" networks (e.g., ResNet-152), adversarial training exhibits a much stronger demand on deeper networks to achieve higher adversarial robustness. This robustness improvement can be observed substantially and consistently even by pushing the network capacity to an unprecedented scale, i.e., ResNet-638.

Adaptive Batch Normalization Networks for Adversarial Robustness

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

Improve Adversarial Robustness Via Probabilistic Distributions Decoupled Network While Guaranteeing Clean Performance

Defending Against Multiple and Unforeseen Adversarial Videos

An adversarial defense algorithm based on robust U-net

Towards Defending Multiple $\ell_p$-norm Bounded Adversarial Perturbations via Gated Batch Normalization

Towards Defending Multiple ℓ_p-Norm Bounded Adversarial Perturbations Via Gated Batch Normalization

Batch Normalization Assisted Adversarial Pruning: Towards Lightweight, Sparse and Robust Models.

Prepare for the Worst: Generalizing across Domain Shifts with Adversarial Batch Normalization

Attack-less adversarial training for a robust adversarial defense

Defending Adversarial Examples via DNN Bottleneck Reinforcement

Towards Understanding Dual BN In Hybrid Adversarial Training

Counterbalancing Teacher: Regularizing Batch Normalized Models for Robustness

Dynamic Label Adversarial Training for Deep Learning Robustness Against Adversarial Attacks

Beneficial Perturbations Network for Defending Adversarial Examples

Intriguing properties of adversarial training at scale

DeepDefense: Training Deep Neural Networks with Improved Robustness.

Patch-aware Batch Normalization for Improving Cross-domain Robustness

Encoding Robustness to Image Style Via Adversarial Feature Perturbations.

Deep Defense: Training DNNs with Improved Adversarial Robustness

Enhancing Robust Representation in Adversarial Training: Alignment and Exclusion Criteria