Towards an Adversarially Robust Normalization Approach

1 INTRODUCTION . In spite of their impressive performance on challenging tasks in computer vision such as image classification and semantic segmentation , deep neural networks ( DNNs ) are shown to be highly vulnerable to adversarial examples , i.e . carefully crafted samples which look similar to natural images but designed to mislead a trained neural network model ( Goodfellow et al. , 2014 ; Nguyen et al. , 2015 ; Carlini & Wagner , 2017 ) . Designing defense mechanisms against these adversarial perturbations has been subjected to much research recently ( Xie et al. , 2019 ; Madry et al. , 2017 ; Tramèr et al. , 2017 ; Papernot et al. , 2016 ) . Meanwhile , Batch Normalization ( BatchNorm or BN ) ( Ioffe & Szegedy , 2015 ) has successfully proliferated throughout all areas of deep learning as it enables stable training , higher learning rates , faster convergence , and higher generalization accuracy . Initially , the effectiveness of the BatchNorm has been attributed to its ability to eliminate the internal covariate shift ( ICS ) , the tendency of the distribution of activations to drift during training . However , later on , alternative reasons including avoiding exploding activations , smooth loss landscape , reducing the sensitivity to initialization , etc . have also been proposed as the basis of BatchNorm ’ s success ( Santurkar et al. , 2018 ; Bjorck et al. , 2018 ; Luo et al. , 2018 ) . While there exist a plethora of reasons for the adversarial vulnerability of deep neural networks ( Jacobsen et al. , 2018 ; Simon-Gabriel et al. , 2018 ) , a recent study by Galloway et al . ( 2019 ) showed that BatchNorm is one of the reasons for this vulnerability . Specifically , they empirically showed that removing the BatchNorm layer enhances robustness against adversarial perturbations . However , removal of BatchNorm also means a sacrifice of benefits such as the use of higher learning rates , faster convergence , and significant improvement in the clean test set accuracy among many others . In this paper , we propose a new perspective regarding the adversarial vulnerability of the BatchNorm layer . Specifically , we probe why BatchNorm layer causes the adversarial vulnerability . We hypothesize that the use of different normalization statistics during training and inference phase ( mini-batch statistics for training and moving average of these statistics also called tracking , at inference time ) is the cause of this adversarial vulnerability of the BatchNorm layer . Our experiments show that by removing this part of the BatchNorm , the robustness of the network increases by 20 % . Similarly , robustness can further be enhanced by up to 30 % after adversarial training . However , by removing the tracking part , the test accuracy on the clean images drops significantly ( though better than without normalization ) . To circumvent this issue , we propose Robust Normalization ( RobustNorm or RN ) . Our experiments demonstrate that RobustNorm not only significantly improve the test performance of adversarially-trained DNNs but is also able to achieve the comparable test accuracy to that of BatchNorm on unperturbed datasets . We perform numerical experiments over standard datasets and DNN architectures . In almost all of our experiments , we obtain a better adversarial robustness performance on perturbed examples for training with natural as well as adversarial training . 2 BACKGROUND . We consider a standard classification task for data , having underlying distribution denoted as D , over the pair of examples x ∈ Rn and corresponding true labels y ∈ { 1 , 2 , ... , k } where k represents different labels . We denote deep neural network ( DNN ) as a function Fθ ( x ) , where θ denotes trainable parameters . θ is learned by minimizing a loss function L ( x , y ) with training data x , y . The output of the DNN is a feature representation f ∈ Rd , that we give input to a classifier C : Rn → { 1 , 2 , ... , k } . The objective of the adversary is to add the additive perturbation δ ∈ Rn under the constrain that the generated adversarial sample xadv = x+ δ that looks visually similar to the true image x , and for which the corresponding labels are not same i.e . C ( x ) 6= C ( xadv ) . In this work , we have added the perturbation via following well-known adversarial attack approaches . Fast Gradient Sign Method : Given an input image x along with its corresponding true label y , FGSM Goodfellow et al . ( 2014 ) aims to generate the adversarial image xadv as , xadv = x+ · sign ( ∇xL ( x , y ) , ( 1 ) where is the perturbation budget that is chosen to be sufficiently small . We use two of its variants : Gradient ( Grad ) where graidents are used and Gradient sign ( GradSign ) which is similar to 1 . Basic Iterative Method ( BIM ) : BIM ( Kurakin et al. , 2016 ) is a straight forward extension of FGSM , that applies it multiple times with a smaller step size . Specifically , x0adv = x , x N adv = Clipx , { x N−1 adv + α · sign ( ∇xL ( x N−1 adv , y ) ) } ( 2 ) where x0adv is the clean image and N denotes iteration number . Carlini-Wagner attack ( CW ) : CW is an effective optimization-based attack model introduced by Carlini & Wagner ( 2017 ) . It works by definining an auxilary variable ϑ and minimizes the following objective functions min ϑ ‖1 2 ( tanh ( ϑ ) + 1 ) − x‖+ c.f ( 1 2 ( tanh ( ϑ ) + 1 ) ) , ( 3 ) where 12 ( tanh ( ϑ ) + 1 ) − x is the perturbation δ , c is a scalar constant , and f ( . ) is defined as : f ( xadv ) = max ( Z ( xadv ) y −max { Z ( xadv ) k : k 6= y } , − % ) ) . ( 4 ) Here , % is to control the adversarial sample ’ s confidence and Zxadv are the logits values for class k. Projected Gradient Descent ( PGD ) : PGD perturbs the true image x for total number of N steps with smaller step sizes . After each step of perturbation , PGD projects the adversarial example back onto the -ball of normal image x , if it goes beyond the -ball . Specifically , xNadv = Π ( x N−1 adv + α.sign ( ∇xL ( x N−1 adv , y ) ) ) , ( 5 ) where Π is the projection operator , α is step size , and xN denotes adversarial example at the N -th step . We have used ` ∞ norm as a distance measure . Gaussian Noise For comparison purposes , we also have used Gaussian noise with 0 mean and 0.25 variance . 2.0.1 ADVERSARIAL TRAINING : It has been shown that empirical risk minimization using only clean images for training can decrease the robustness performance of DNNs . A standard approach to achieve the adversarial robustness in DNNs is adversarial training which involves fitting a classifier C on adversarially-perturbed samples along with clean images . We have used PGD based adversarial training which has shown to be effective against many firstorder adversaries ( Madry et al. , 2017 ) unlike other methods which overfit for on a single attack . 2.1 EXPERIMENTAL SETUP . We have used two network architectures , Resnet He et al . ( 2016 ) with 20,38 and 50 layers and VGG Simonyan & Zisserman ( 2014 ) with 11 and 16 layers . We have used CIFAR10 and 100 datasets ( Krizhevsky et al. , 2009 ) for all the evaluations . We have used term natural training for training with clean images while adversarial training is done with PGD based method formulated by Madry et al . ( 2017 ) . We have always used a learning rate of 0.1 except for no normalization scenarios where convergence is not possible with higher learning rates . In such cases , we have used a learning rate of 0.001 . We decrease the learning rate 10 times after 120 epochs and trained all the networks for 164 epochs . For robustness evaluations , we have used =0.03/1 for most of the experiments and used 20 epochs for all the iterative attacks . We also have tested the model on different noise levels ranging from 0.003/1 to 0.9/1 . 3 HOW DOES BATCHNORM CAUSES ADVERSARIAL VULNERABILITY . 3.1 HOW BATCHNORM WORKS . In this section , we briefly explain the working principle of BatchNorm layer . Broadly speaking , the BatchNorm layer has been introduced to circumvent the issue of internal covariate shift ( ICS ) . Consider a minibatch B of size M , containing samples xm for m = 1 , 2 , ... , M . BatchNorm normalizes the mini-batch during training , by calculating the mean µβ and variance σ2β as follows : µB = 1 M M∑ i=1 xi ; σB = √√√√ 1 M M∑ i=1 ( xi − µB ) 2 + . ( 6 ) Activation normalization is then performed as , x̂i = xi − µB σB . ( 7 ) To further compensate for the possible loss of representational ability of network , BatchNorm also learns per-channel linear transformation as : yi = γx̂i + B , ( 8 ) for trainable parameters γ and β that represent scale and shift , respectively . These parameters are learnt using the same procedure , such as stochastic gradient descent , as other weights in the network . During training , the model usually maintains the moving averages of mini-batch means and variances ( a.k.a . tracking ) , and during inference , uses these tracked statistics in place of the mini-batch statistics . Formally , tracking ( moving average ) of mean and variance , for scalar τ are given as , µ̂ = ( 1− τ ) µ̂+ τµβ , σ̂2 = ( 1− τ ) σ̂2 + τσ2B ( 9 ) For inference , we can write , ytest = xtest − µ̂ σ̂ .γ + β . ( 10 ) 3.2 BATCHNORM AND ADVERSARIAL VULNERABILITY . Recently , Galloway et al . ( 2019 ) empirically showed that the accelerated training properties and occasionally higher clean test accuracy of employing BatchNorm in network come at the cost of low robustness to adversarial perturbations . While removing the BatchNorm layer may be helpful for robustness , it also means the loss of desirable properties of BatchNorm like very high learning rate , faster convergence , boost in test accuracy , etc . Therefore , it is pertinent to devise a normalization method that is not only robust to the adversarial perturbations but also inherits the desirable properties of the BatchNorm layer . 3.3 DEVIL IS IN THE TRACKING . In this section , we aim to investigate the reasons behind the adversarial vulnerability of the BatchNorm layer on the following two grounds ; • We note that during training , mini-batch statistics are used to normalize activations as shown in Equations 6 and 7 . Moving average of these statistics are also calculated during the training that is called tracking ( shown in Equation 9 ) . The tracked mean and variance are used in the inference step ( Equation 10 ) . In this way , different values for mean and variance are used during training and inference . We show this in Figure 1 where it is clear that batch statistics at the start of the training are very different from tracked values that are used at the inference . • Our second observation is based on the recent work of ( Ding et al. , 2019 ; Jacobsen et al. , 2019 ) . These works shed light on the link of the distributional shift in input data and robustness . Specifically , Ding et al . ( 2019 ) showed that adversarial robustness is highly sensitive to change in the input data distribution and prove that even a semantically-lossless shift on the data distribution could result in drastically different robustness for adversarially trained models . Based on the above two observations , we hypothesize that : Different values of first-order statistics ( mean and variance ) are used in the normalization layer for training and inference . This means different internal representations being used at training and inference time which causes drift in input distributions of these layers . Therefore , the tracking part is the main culprit behind the adversarial vulnerability of the BatchNorm layer . To prove our hypothesis , we have done extensive experiments . For each experiment , we train a neural network model with three different normalization layers : BatchNorm , BatchNorm without tracking , and no normalization . To prove the generality of our argument , we have used various architectures , depths , and datasets as written in section 2.1 . We train these networks on clean images as well as with based adversarial training procedure . For adversarial training , we use PGD attack for perturbation . We choose PGD due to its ability to generalize well for other adversarial attacks . Table 1 shows our results on Resnet20 . For detailed experimental results on various architectures , depths and dataset with different attacks see Table 4 , 5 in appendix . The results clearly show that while the elimination of BatchNorm and training at a very small learning rate can help increase robustness , it also reduces clean data accuracy ( with BatchNorm ) . More importantly , this proves our hypothesis that by removing tracking , we can increase the robustness of a neural network significantly . By using BatchNorm without tracking , we also keep many benefits of BatchNorm . Unfortunately , by eliminating the tracking part of BatchNorm , clean accuracy of a network also reduces as compared to clean accuracy with BatchNorm . We tackle this issue in the next section .

Summary: Review: This paper investigates the reason behind the vulnerability of BatchNorm and proposes a Robust Normalization. They experimentally show that it is the moving averages of mini-batch means and variances (tracking) used in Normalization that cause the adversarial vulnerability. Based on this observation, they propose a new normalization method not only achieves significantly better results under a variety of attack methods but ensures a comparable test accuracy to that of BatchNorm on unperturbed datasets. The paper is clearly written, easy to read.