Towards an Adversarially Robust Normalization Approach

1 INTRODUCTION . In spite of their impressive performance on challenging tasks in computer vision such as image classification and semantic segmentation , deep neural networks ( DNNs ) are shown to be highly vulnerable to adversarial examples , i.e . carefully crafted samples which look similar to natural images but designed to mislead a trained neural network model ( Goodfellow et al. , 2014 ; Nguyen et al. , 2015 ; Carlini & Wagner , 2017 ) . Designing defense mechanisms against these adversarial perturbations has been subjected to much research recently ( Xie et al. , 2019 ; Madry et al. , 2017 ; Tramèr et al. , 2017 ; Papernot et al. , 2016 ) . Meanwhile , Batch Normalization ( BatchNorm or BN ) ( Ioffe & Szegedy , 2015 ) has successfully proliferated throughout all areas of deep learning as it enables stable training , higher learning rates , faster convergence , and higher generalization accuracy . Initially , the effectiveness of the BatchNorm has been attributed to its ability to eliminate the internal covariate shift ( ICS ) , the tendency of the distribution of activations to drift during training . However , later on , alternative reasons including avoiding exploding activations , smooth loss landscape , reducing the sensitivity to initialization , etc . have also been proposed as the basis of BatchNorm ’ s success ( Santurkar et al. , 2018 ; Bjorck et al. , 2018 ; Luo et al. , 2018 ) . While there exist a plethora of reasons for the adversarial vulnerability of deep neural networks ( Jacobsen et al. , 2018 ; Simon-Gabriel et al. , 2018 ) , a recent study by Galloway et al . ( 2019 ) showed that BatchNorm is one of the reasons for this vulnerability . Specifically , they empirically showed that removing the BatchNorm layer enhances robustness against adversarial perturbations . However , removal of BatchNorm also means a sacrifice of benefits such as the use of higher learning rates , faster convergence , and significant improvement in the clean test set accuracy among many others . In this paper , we propose a new perspective regarding the adversarial vulnerability of the BatchNorm layer . Specifically , we probe why BatchNorm layer causes the adversarial vulnerability . We hypothesize that the use of different normalization statistics during training and inference phase ( mini-batch statistics for training and moving average of these statistics also called tracking , at inference time ) is the cause of this adversarial vulnerability of the BatchNorm layer . Our experiments show that by removing this part of the BatchNorm , the robustness of the network increases by 20 % . Similarly , robustness can further be enhanced by up to 30 % after adversarial training . However , by removing the tracking part , the test accuracy on the clean images drops significantly ( though better than without normalization ) . To circumvent this issue , we propose Robust Normalization ( RobustNorm or RN ) . Our experiments demonstrate that RobustNorm not only significantly improve the test performance of adversarially-trained DNNs but is also able to achieve the comparable test accuracy to that of BatchNorm on unperturbed datasets . We perform numerical experiments over standard datasets and DNN architectures . In almost all of our experiments , we obtain a better adversarial robustness performance on perturbed examples for training with natural as well as adversarial training . 2 BACKGROUND . We consider a standard classification task for data , having underlying distribution denoted as D , over the pair of examples x ∈ Rn and corresponding true labels y ∈ { 1 , 2 , ... , k } where k represents different labels . We denote deep neural network ( DNN ) as a function Fθ ( x ) , where θ denotes trainable parameters . θ is learned by minimizing a loss function L ( x , y ) with training data x , y . The output of the DNN is a feature representation f ∈ Rd , that we give input to a classifier C : Rn → { 1 , 2 , ... , k } . The objective of the adversary is to add the additive perturbation δ ∈ Rn under the constrain that the generated adversarial sample xadv = x+ δ that looks visually similar to the true image x , and for which the corresponding labels are not same i.e . C ( x ) 6= C ( xadv ) . In this work , we have added the perturbation via following well-known adversarial attack approaches . Fast Gradient Sign Method : Given an input image x along with its corresponding true label y , FGSM Goodfellow et al . ( 2014 ) aims to generate the adversarial image xadv as , xadv = x+ · sign ( ∇xL ( x , y ) , ( 1 ) where is the perturbation budget that is chosen to be sufficiently small . We use two of its variants : Gradient ( Grad ) where graidents are used and Gradient sign ( GradSign ) which is similar to 1 . Basic Iterative Method ( BIM ) : BIM ( Kurakin et al. , 2016 ) is a straight forward extension of FGSM , that applies it multiple times with a smaller step size . Specifically , x0adv = x , x N adv = Clipx , { x N−1 adv + α · sign ( ∇xL ( x N−1 adv , y ) ) } ( 2 ) where x0adv is the clean image and N denotes iteration number . Carlini-Wagner attack ( CW ) : CW is an effective optimization-based attack model introduced by Carlini & Wagner ( 2017 ) . It works by definining an auxilary variable ϑ and minimizes the following objective functions min ϑ ‖1 2 ( tanh ( ϑ ) + 1 ) − x‖+ c.f ( 1 2 ( tanh ( ϑ ) + 1 ) ) , ( 3 ) where 12 ( tanh ( ϑ ) + 1 ) − x is the perturbation δ , c is a scalar constant , and f ( . ) is defined as : f ( xadv ) = max ( Z ( xadv ) y −max { Z ( xadv ) k : k 6= y } , − % ) ) . ( 4 ) Here , % is to control the adversarial sample ’ s confidence and Zxadv are the logits values for class k. Projected Gradient Descent ( PGD ) : PGD perturbs the true image x for total number of N steps with smaller step sizes . After each step of perturbation , PGD projects the adversarial example back onto the -ball of normal image x , if it goes beyond the -ball . Specifically , xNadv = Π ( x N−1 adv + α.sign ( ∇xL ( x N−1 adv , y ) ) ) , ( 5 ) where Π is the projection operator , α is step size , and xN denotes adversarial example at the N -th step . We have used ` ∞ norm as a distance measure . Gaussian Noise For comparison purposes , we also have used Gaussian noise with 0 mean and 0.25 variance . 2.0.1 ADVERSARIAL TRAINING : It has been shown that empirical risk minimization using only clean images for training can decrease the robustness performance of DNNs . A standard approach to achieve the adversarial robustness in DNNs is adversarial training which involves fitting a classifier C on adversarially-perturbed samples along with clean images . We have used PGD based adversarial training which has shown to be effective against many firstorder adversaries ( Madry et al. , 2017 ) unlike other methods which overfit for on a single attack . 2.1 EXPERIMENTAL SETUP . We have used two network architectures , Resnet He et al . ( 2016 ) with 20,38 and 50 layers and VGG Simonyan & Zisserman ( 2014 ) with 11 and 16 layers . We have used CIFAR10 and 100 datasets ( Krizhevsky et al. , 2009 ) for all the evaluations . We have used term natural training for training with clean images while adversarial training is done with PGD based method formulated by Madry et al . ( 2017 ) . We have always used a learning rate of 0.1 except for no normalization scenarios where convergence is not possible with higher learning rates . In such cases , we have used a learning rate of 0.001 . We decrease the learning rate 10 times after 120 epochs and trained all the networks for 164 epochs . For robustness evaluations , we have used =0.03/1 for most of the experiments and used 20 epochs for all the iterative attacks . We also have tested the model on different noise levels ranging from 0.003/1 to 0.9/1 . 3 HOW DOES BATCHNORM CAUSES ADVERSARIAL VULNERABILITY . 3.1 HOW BATCHNORM WORKS . In this section , we briefly explain the working principle of BatchNorm layer . Broadly speaking , the BatchNorm layer has been introduced to circumvent the issue of internal covariate shift ( ICS ) . Consider a minibatch B of size M , containing samples xm for m = 1 , 2 , ... , M . BatchNorm normalizes the mini-batch during training , by calculating the mean µβ and variance σ2β as follows : µB = 1 M M∑ i=1 xi ; σB = √√√√ 1 M M∑ i=1 ( xi − µB ) 2 + . ( 6 ) Activation normalization is then performed as , x̂i = xi − µB σB . ( 7 ) To further compensate for the possible loss of representational ability of network , BatchNorm also learns per-channel linear transformation as : yi = γx̂i + B , ( 8 ) for trainable parameters γ and β that represent scale and shift , respectively . These parameters are learnt using the same procedure , such as stochastic gradient descent , as other weights in the network . During training , the model usually maintains the moving averages of mini-batch means and variances ( a.k.a . tracking ) , and during inference , uses these tracked statistics in place of the mini-batch statistics . Formally , tracking ( moving average ) of mean and variance , for scalar τ are given as , µ̂ = ( 1− τ ) µ̂+ τµβ , σ̂2 = ( 1− τ ) σ̂2 + τσ2B ( 9 ) For inference , we can write , ytest = xtest − µ̂ σ̂ .γ + β . ( 10 ) 3.2 BATCHNORM AND ADVERSARIAL VULNERABILITY . Recently , Galloway et al . ( 2019 ) empirically showed that the accelerated training properties and occasionally higher clean test accuracy of employing BatchNorm in network come at the cost of low robustness to adversarial perturbations . While removing the BatchNorm layer may be helpful for robustness , it also means the loss of desirable properties of BatchNorm like very high learning rate , faster convergence , boost in test accuracy , etc . Therefore , it is pertinent to devise a normalization method that is not only robust to the adversarial perturbations but also inherits the desirable properties of the BatchNorm layer . 3.3 DEVIL IS IN THE TRACKING . In this section , we aim to investigate the reasons behind the adversarial vulnerability of the BatchNorm layer on the following two grounds ; • We note that during training , mini-batch statistics are used to normalize activations as shown in Equations 6 and 7 . Moving average of these statistics are also calculated during the training that is called tracking ( shown in Equation 9 ) . The tracked mean and variance are used in the inference step ( Equation 10 ) . In this way , different values for mean and variance are used during training and inference . We show this in Figure 1 where it is clear that batch statistics at the start of the training are very different from tracked values that are used at the inference . • Our second observation is based on the recent work of ( Ding et al. , 2019 ; Jacobsen et al. , 2019 ) . These works shed light on the link of the distributional shift in input data and robustness . Specifically , Ding et al . ( 2019 ) showed that adversarial robustness is highly sensitive to change in the input data distribution and prove that even a semantically-lossless shift on the data distribution could result in drastically different robustness for adversarially trained models . Based on the above two observations , we hypothesize that : Different values of first-order statistics ( mean and variance ) are used in the normalization layer for training and inference . This means different internal representations being used at training and inference time which causes drift in input distributions of these layers . Therefore , the tracking part is the main culprit behind the adversarial vulnerability of the BatchNorm layer . To prove our hypothesis , we have done extensive experiments . For each experiment , we train a neural network model with three different normalization layers : BatchNorm , BatchNorm without tracking , and no normalization . To prove the generality of our argument , we have used various architectures , depths , and datasets as written in section 2.1 . We train these networks on clean images as well as with based adversarial training procedure . For adversarial training , we use PGD attack for perturbation . We choose PGD due to its ability to generalize well for other adversarial attacks . Table 1 shows our results on Resnet20 . For detailed experimental results on various architectures , depths and dataset with different attacks see Table 4 , 5 in appendix . The results clearly show that while the elimination of BatchNorm and training at a very small learning rate can help increase robustness , it also reduces clean data accuracy ( with BatchNorm ) . More importantly , this proves our hypothesis that by removing tracking , we can increase the robustness of a neural network significantly . By using BatchNorm without tracking , we also keep many benefits of BatchNorm . Unfortunately , by eliminating the tracking part of BatchNorm , clean accuracy of a network also reduces as compared to clean accuracy with BatchNorm . We tackle this issue in the next section .

Summary: This paper addresses a limitation of BatchNorm: vulnerability to adversarial perturbations. The authors propose a possible explanation of this issue and correspondingly an alternative called RobustNorm to tackle this problem. Specifically, the authors observe that the statistics of BatchNorm for training and inference are different, resulting in different data distributions for training and inference. To solve this problem, the authors propose to use min-max rescaling instead of normalization. In addition, the running average is calculated with mean and the running mean of the denominator during inference. Experimental results show significant improvement of robustness and also comparable accuracy for clean data.