Prepare for the Worst: Generalizing across Domain Shifts with Adversarial Batch Normalization
Authors: Manli Shu
Zuxuan Wu
Micah Goldblum
Tom Goldstein
Venue:  (2021)
Keywords: adversarial training
distributional shifts

Abstract: Adversarial training is the industry standard for producing models that are robust to small adversarial perturbations.  However, machine learning practitioners need models that are robust to other kinds of changes that occur naturally, such as changes in the style or illumination of input images. Such changes in input distribution have been effectively modeled as shifts in the mean and variance of deep image features.   We adapt adversarial training by adversarially perturbing these feature statistics, rather than image pixels, to produce models that are robust to distributional shifts. We also visualize images from adversarially crafted distributions. Our method, Adversarial Batch Normalization (AdvBN), significantly improves the performance of ResNet-50 on ImageNet-C (+8.1%), Stylized-ImageNet (+6.7%), and ImageNet-Instagram (+3.9%) over standard training practices.  In addition, we demonstrate that AdvBN can also improve generalization on semantic segmentation.

Under review as a conference paper at ICLR 2021
PREPARE FOR THE WORST: GENERALIZING ACROSS DOMAIN SHIFTS WITH ADVERSARIAL BATCH NOR- MALIZATION
Anonymous authors Paper under double-blind review
ABSTRACT
Adversarial training is the industry standard for producing models that are robust small adversarial perturbations, However, machine learning practitioners need mod- els that are robust other kinds of changes that occur naturally, such as changes the style or illumination of input images. Such changes in input distribution have been effectively modeled as shifts in the mean and variance of deep image features. We adapt adversarial training by adversarially perturbing these feature statistics, rather than image pixels, to produce models that are robust to distributional shifts. We also visualize images from adversarially crafted distributions. Our method, Adversarial Batch Normalization (AdvBN), significantly improves the performance of ResNet-50 ImageNet-C (+8.1%), Stylized-ImageNet (+6.7%), and ImageNet- Instagram (+3.9%) over standard training practices. In addition, we demonstrate that AdyBN also improve generalization semantic segmentation.
ImageNet
ImageNettCC
Sty lnyliize--lngeNe
ImageNet-AdviN
99.9%
guldfinch
89.6%
guldfinch
57.4%
goldfinch
16.2%
gong
10.3%
hen-of-the-moodds
0.05%
bulbul
7.4%
sulphur butterfy
11.5%
brambling
8.8%
bolete
Ubizan bound flaningo
0.0255
0.5%
humminghind
guillotine
squirrel
Figure Images from ImageNet variants along with classification scores by a pre-trained ResNet-50 model. The right-most image is generated by our Adversarial Batch Normalization module. Details on how we generate this image can be found in Section
INTRODUCTION
Robust optimization for neural networks has been a major focus of recent research. A mainstream approach reducing the brittleness of classifiers adversarial training, which solves a min-max optimization problem in which an adversary makes perturbations to images to degrade network performance, while the network adapts parameters to resist degradation (Goodfellow al.) 2015) Kurakin et al. 2017] Madry et al. 2018). The result is a hardened network that is no longer brittle to small perturbations to input pixels. While adversarial training makes networks robust to adversarial perturbations, it does not address other forms of brittleness that plague vision systems. For example, shifts in image style, lighting, color mapping, and domain shifts can still severely degrade the performance of neural networks (Hendrycks & Dietterich 2019).
We propose adapting adversarial training to make neural networks robust to changes in image style and appearance, rather than small perturbations the pixel level. We formulate min-max game in which an adversary chooses adversarial feature statistics, and network parameters are then updated to resist these changes in feature space that correspond to appearance differences of input images. This

---

Under review as a conference paper at ICLR 2021
game is played until the network is robust to variety of changes in image space including texture, color, brightness, etc.
The idea of adversarial feature statistics is inspired by the observation that the mean and variance of features maps encode style information, and thus, they enable the transfer of style information from source image target image through normalization (Huang & Belongie 2017 UTyanov et al. 2016). Unlike standard approaches that rely on feature statistics from auxiliary images to define an image style, we use adversarial optimization of feature statistics prepare classifiers for the worst-case style that they might encounter.
We propose training with Adversarial Batch Normalization (AdvBN) layers. Before each gradient update, the AdvBN layers perform an adversarial feature shift by re-normalizing with the most damaging mean and variance. By using these layers in robust optimization framework, we create networks which are resistant to any domain shift caused by feature statistics shift. An advantage of this method is that it does not require additional auxiliary data from new domains. We show that robust training with AdvBN layers hardens classifiers against changes in image appearance (Geirhos et al.) (019) and
and style using a range of vision tasks including ImageNet-Instagran (Wu et al. 2020).
BACKGROUND
2.1 FEATURE NORMALIZATION
Feature normalization an important component of modern neural networks that stabilizes training and improves model generalization. Let f RxCx H denote feature maps output by a layer, where N is the batch size, C is the number of channels, and H and W represent the height and width of the feature maps, respectively. Different normalization methods compute the mean, J4, and standard deviation, a, over different dimensions the feature maps. They use the derived feature statistics, often along with learned multiplicative and additive parameters, to produce normalized features, f":
-' f ((p(-(( p(f) o()
+ +3,
(1)
where yy and 3 are learnable parameters which re-scale and shift normalized features. For example, Batch Normalization (BN) (loffe Szegedy (015) estimates feature statisties along the N, H, W dimensions. On the other hand, Instance Normalization (IN) (Ulyanov et al.) (016) computes μ and a for each individual sample in the batch and only normalizes across the H and dimensions.
Although feature normalization was originally proposed to accelerate the training process (Bjorck al. 2018), previous work (Huang & Belongie 2017 [i et al.) 2017) has shown that feature statistics effectively capture information concerning the appearance of images. Motivated by this observation, we impose uncertainty on these statistics during training in order to obtain models that are less sensitive non-semantic characteristics, thus generalizing to images with different appearances.
2.2 ADVERSARIAL TRAINING
Untargeted adversarial examples are generated by maximizing classification loss with respect to the input. One popular method, projected gradient descent (PGD), involves performing gradient ascent in the signed gradient direction and projecting the perturbation in order to enforce an fce constraint (Madry et al.) 2018). Adversarial training aims to solve the saddlepoint optimization problem,
min E (X
max L(ga + +0, [1
where ge is model with parameter vector 0, y is clean input and the corresponding label drawn from distribution D, and L denotes cross-entrope loss. Adversarial training solves this problem by iteratively sampling batch of data, perturbing the batch adversarially, and performing a parameter update on the new adversarial batch (Madry et al. 2018). We harness adversarial training in order to create models robust to distributional shifts rather than the standard wixel-wise adversarial attacks.
2

---

Under review as a conference paper at ICLR 2021
3 ADVERSARIAL BATCH NORMALIZATION
We propose Adversarial Batch Normalization (AdvBN), a module that adversarially perturbs deep feature distributions such that the features confuse CNN classifiers. We iteratively compute adversarial directions in feature space by taking PGD steps on batch statistics. In the next section, we will train on these perturbed feature distributions in order to produce models robust to domain shifts.
Consider a pre-trained classification network, 9, with L layers. We divide into two parts, g²d and g where gtt." denotes layers m through n. Now, consider batch of data, I, with corresponding labels, y. Formally, the AdvBN module is defined by
BN (x (z;g, = 8. - (f-()))) +8 plf), where f gx)
(8x arg max (o) C g 80 -0- 5p 11()) mn())
(3)
subject to || 1|100 S E, 11ó
1| S
where the maximization problem is solved with projected gradient descent. Simply put, the AdvBN module is PGD attack on batch norm statistics which can be inserted inside network. Note that onr Or are vectors with length equal to the number of channels in the output of layer and we multiply by them entry-wise, one scalar entry per channel, similarly to Batch Normalization. Additionally, note that this module acts on a per-batch basis so that features corresponding to an individual image may be perturbed differently depending on the batch the image is in.
We formulate the perturbation by first subtracting out the mean so that 6y =u(f) is the new mean of the adversarial features, and 6, directly controls the new mean. We choose 6, j(f)), rather than simply 5u to represent the new mean of the perturbed features so that foo bounds and steps size do not need to depend on the mean of f.
Visualizing feature shifts To verify assumption that adversarially perturbing feature statistics corresponds to transforming the distribution in image space, we visualize the effects AdvBN. We adopt the VGG-19 based autoencoder from Huang & Belongie (2017). At the bottleneck of the autoencoder, we plug in an AdvBN module We visualize perturbations by feeding the AdvBN outputs the decoder.
In Figure 2 images crafted through this procedure are visibly different from the originals; semantic content in the original images is preserved, but the new images exhibit differences in color, texture, and edges. We draw two major conclusions from these visualizations which highlight the adversarial properties of these domains. The first one concerns textures: according to Geirhos et (2019). CNNs rely heavily on image textures for classification. Images from the adversarial domain, on the other hand, have inconsistent textures across samples. For example, the furry texture of dog is smoothed in column 2, and the stripes disappear from a zebra in column 4, whereas visible textures appear in columns 6 and 8. The second conclusion pertains to color. Results Zhang et al. (2016) suggest that colors serve as important information for CNNs. In the adversarial domain, we find
Figure 2: Examples of perturbed ImageNet images generated by AdyBN with decoder. The first row contains the original versions from the ImageNet validation set.
3

---

Under review as a conference paper at ICLR 2021
suppressed colors (columns 1, 3) and unnatural hue (columns 5, 7). See Appendix A.3 for additional example images generated by this procedure. Figure illustratts how the appearance of reconstructed images shifts adversarial perturbations feature statisties become larger.
We use this visualization technique to process the entire ImageNet validation set and denote it as ImageNet-AdvBN in Figure [ By evaluating different methods this dataset, observe that performance on ImageNet-AdvBN is consistently degraded, which validates the adversarial property of features generated by AdvBN, Experiments concerning performance on ImageNet-AdvBN listed in Appendix A.2.
Original
0.3
0.5
Adversarial Strength
Figure 3: The effect of adversarial strength visualized examples. corresponds images reconstructed by our autoencoder without AdvBN.
4 TRAINING WITH ADVERSARIAL BATCH NORMALIZATION
In this section, we use the proposed AdvBN module to train networks on the perturbed features. The goal is to produce networks that generalize well unseen domains while maintain performance on training data distribution, all without having to obtain auxiliary data from new domains.
We start with pre-trained model, g = = g gh.,, and we fine-tune the subnetwork, g on clean and adversarial features simultaneously. To this end, we solve the following min-max problem,
min ( max C(g 141,1. BN gz + L(ge
1+1,5 " (z))()))))
where L. denotes cross-entropy loss, and ' is the distribution of batches of size In order to maintain the network's performance on natural images, we adopt a similar approach to Xie al. (2020) by using auxiliary batch normalization in g for adversarial features; we use the original BNs when propagating clean features, and we use auxiliary ones for adversarial features. See Algorithm for detailed description of our method.
Since we start with pre-trained models, we only need to fine-tune 20 epochs, yielding improved robustness with little additional computation. Moreover, only modify the parameters of later layers, so we do not need to backpropagate through the first half of the network. See Appendix for analysis of training budget using method. In the following section, measure the performance, on several datasets, of our model fine-tuned using adversarial training with AdvBN.
5 EXPERIMENTS
5.1
IMPLEMENTATION
Our method begins with a torchvision ImageNet pre-trained ResNet-50 (He et al. 2016). We insert the AdvBN module at the end of the 2nd convolutional stage. The model is fine-tuned following Algorithm for 20 epochs. The learning rate starts at 0.001 and decreases by a factor of 10 after 10 epochs with a batch size of 256. We use SGD with momentum 0.9 and weight decay coefficient 10 10-4. We augment inputs with a fixed AutoAugment (Cubuk et al. 2019) policy. Adversarial parameters
= 0.2 and
1.1 with repeats.
4

---

Under review as a conference paper at ICLR 2021
Algorithm 1: Training with Adversarial Batch Normalization
Input:
Training data, pretrained network Do 5 gg q, PGD bound e, and PGD step size 141.Z
Result: Updated network parameters, 8, of subnetwork 9g for each training step do
Sample mini-batch x with lahel y;
Obtain feature map (z)) Initialize perturbation: 5 (6 6o);
Let fodu = f:
for adversarial step 1,..., m do
fado +- 6g (f w(f)) + 8n :(f):
Update 8: 5 8 T sign( V Lig
1+1.1 (fade); v));
8 t clip (6, 1 e, t);
end
S Sadu < 8, (S m(() + dp p()):
Minimize the total loss w.r.t. network parameter:
0 + arg min L(g,=1) 1+1," (fadv)) y) + L(o, (11,) (f),,))
end return 0
5.2
GENERALIZATION TO IMAGENET VARIANTS
Datasets. We compare our method to other methods designed to produce classification networks which generalize better. The datasets we consider are variants of ImageNet (Deng et al. 2009):
ImageNet-C (Hendrycks & Dietterich 2019) contains distorted images with 15 categories of common image corruption applied, each with 5 levels of severity. Performance on this dataset is measured by mean Corruption Error (mCE), the average classification error over all 75 combinations of corruption type and severity level, weighted by their difficulty.
mmageNet-IIstagraan (Wu al. 2020) is composed of ImageNet images filtered with total of 20 different Instagram filters. This dataset contains 20 versions of each ImageNet image, each with different filter applied.
Stylized-Imagel (Geirhos et al.) 2019) consists of images from the ImageNet dataset, each stylized using AdaIN (Huang & Belongie| (017)) with a randomly selected painting. Textures and colors of images this dataset differ heavily from the originals.
Models. Our baseline model is the publicly available torchvision ResNet-50 pre-trained on Ima- geNet, denoted as "Standard" in Table All models compare to, aside from SIN (Geirhos et al. 2019), are not trained on any the ImageNet variants that are used for evaluation. The PGD model adversarially trained with the PGD attack on inputs and is provided by [Enstrrm et al. (2019). MoEx eLi al.) 2020) changes feature moments inside networks but not in an adversarial manner. IBN-Net (Pan et al. (2018) improves the generalization of networks by combining batch normalization AugMix (Hendrycks er al., 2020) is a data augmentation method that solves the distributional mismatch between training and testing data and increases classification robustness. SIN is network trained on both Stylized ImageNet and ImageNet. We do not measure the accuracy of SIN on Stylized-Ime ImageNet since it acquires knowledge of the target domain during training. Note that all models we use in our comparisons are the original versions released by the authors of the original work.
and instance normalization
Results. As shown in Table the performance of baseline model significantly degrades on all three ImageNet variants, highlighting the brittleness of standard classification model when tested on novel distributions. Fine-tuning with AdvBN, on the other hand, substantially improves the performance of the standard ResNet-50 model. In particular, achieve 8. 1% accuracy gain on ImageNet-C through fine-tuning with AdvBN. On Htylized-ImageNee and TaageNet-Instarrann our model also achieves the best performance among all methods with which we compare. The consistent performance boost across all three benchmarks demonstrates that AdvBN can effectively enhance robustness against various distributional shifts. Note that this AdvBN model has additional auxiliary
5

---

Under review as a conference paper at ICLR 2021
Table 1: Performance of AdvBN and alternative methods on ImageNet variants.
ImageNet-C mCE
ImageNet-Instagral top1/ top5 acc.
Stylized-ImageNee topl/ top5 acc.
Model
Standard
76.7
67.2/ 87.6
7.4/ 16.4
PGD
85.0
49.0/ 71.4
12.3/ 23.9
MoEx
74.8
70.0/ 89.4
5.0/ 12.0
IBN-Net
70.3
69.6/ 89.3
10.7/ 22.2
Augmix
68.4
70.4/ 89.4
11.2/ 23.1 -/-
SIN
69.3
66.9/ 87.4
AdvBN
68.6
71.1/ 89.5
14.1/ 26.9
BN layers, its performance on the original ImageNet is well maintained, will be shown in Table in the next subsection. Appendix C gives details of inference with auxiliary BN layers. Besides ResNet-55,, we also applied AdvBN fine-tune other model architectures. From Table 2 see that AdvBN improves the performance of both DenseNet and EfficientNet architectures.
Table 2: Applying AdyBN to other architectures.
Table 3: Performance of AdvBN and an alternative method: AdvProp, on EfficientNet-BO.
Architecture
ImageNet-C mCE, +
ImageNet-Ing topl acc.
ImageNet-Styl. tupl ucc.
DenseNet-121
73.4
66.6
7.9
Dataset
AdvProp
AdvBN
+ AdvBN
70.4
69.3
15.5
ImageNet-C 66.2
68.7
EfficientNet-BO
72.1
69.7
12.5
ImageNet-Ins.
70.6
71.3
+ +dvVBN
68.7
71.3
15.7
ImageNet-Styl. 14.6
15.7
With our results on EfficientNet, we are able to compare to another alternative method, AdvPropl Xie et al. 2020), which also adopts adversarial training framework for improving the performance of neural networks. Since no official ResNet-50 model this method is available, we list the comparison results in Table [eparatelyy with EfficientNet-BO architecture.
5.3 ABLATION STUDY
Where should the AdyBN module be placed within network? The proposed AdvBN module can be inserted after any layer in network. In this part, we try AdvBN with different positions, conv3_4 and conv4_6 6. From the results in Table we observe that conv4_ 6 yields the worst performance among all three ImageNet variants, indicating that using AdvBN at such deep layer is helpful as at shallower layers. We hypothesize two possible explanations for this phenomenon: (1) there are fewer trainable parameters when only very deep layers are fine-tuned; (2) features are more abstract deeper layers, and perturbing these high-level features can lead to extremely chaotic feature representations that are harmful for classification.
Table 4: Ablation studies.
ImageNet topl acc.
ImageNet-C
ImageNet-Ins. topl f
ImageNet-Styl. top1 acc. 1
Model
Standard
76.1
76.7
67.2
7.4
== conv2_3
76.5
68.6
71.1
14.1
I corv3_4
76.0
70.0
70.2
19.5
corv4_6
75.3
68.5
6 = 0.5
76.5
69.4
70.8
13.3
70.9
0.9
76.6
69.0
71.0
13.8
1.1
76.5
68.6
71.1
14.1
1.3
76.4
68.3
70.7
13.2
76.2
68.8
70.4
13.1
AutoAugment
76.4
72.1
70.1
Adversarial strength. The strength of the adversarial attack in the adversarial training framework has major impact model performance (Madry et al.) 2018). We test range of PGD parameters to demonstrate how the strength of AdvBN affects model performance. We measure strength by the perturbation bound e, where fix to be 0.2 for all settings, and change the number of repeats for

---

Under review as a conference paper at ICLR 2021
different bounds. The number of repeats n for each is set to be n [e/0.2] + 1. Results concerning the impact of adversarial strength are listed in Table
Data augmentation. AdvBN performing in feature space can easily be combined with input space data augmentation. To determine what portion the improvements we observed can be credited to AdvBN, we fine-tune pre-trained ResNet-50 following the same routine before but without the AdvBN module, adopting the same fixed AutoAugment policy along with all other hyperparameters. This method is denoted by AutoAugment in Table 4 alone does not result in nearly as much improvement as the combined method on all datasets we consider; even performance the original ImageNet dataset benefits from the AdvBN module.
We see that fine-tuning with Autonugment
5.4 FEATURE DIVERGENCE ANALYSIS
We compare the features extracted by our network to those of standard ResNet-50 trained on ImageNet. Following |aan et al. (2018), we model features from each channel using a normal distribution with the same mean and standard deviation, and we compute the symmetric KL divergence between the corresponding distributions on the two datasets (A and B). For two sets of deep features, FA and FB, each with C' channels, the divergence D(F is computed using the formula,
D(FAIIFB) (KL(FAAAAAIL +
(L(FBI(FA).
(5)
KL log de
1ut 20
2
where F denotes the features of i-th channel with mean J and standard deviation o² In Figure 4 we compare the baseline model with our own on two pairs of datasets in the fine-tuned layers. Since ImageNet-Instagran contains 20 filter versions, we use the "Toaster" filter found in Wu et al. 2020) to cause the sharpest drop in classification performance. We find that the feature
ImageNet vs. Stylized-Imageee
ImageNett maagelet-iinstarrem
Standardd
Standard
Adv
AdvENi
Feature divergence
0.8
0.4
0.2
0.0
8
10
11
12
13
14
15
16
11
12
1.
14
15
16
Block Indox
Block Index
Figure 4: Feature divergence between pairs of datasets using features extracted by AdyBN and standard ResNet50.
divergence in our network trained with AdvBN is substantially smaller on all layers in the fine-tuned subnetwork. The small divergence between feature representations explains the effectiveness of AdvBN from a different angle and explains why our model generalizes well across datasets.
5.5 GENERALIZATION ON SEMANTIC SEGMENTATION
We now evaluate AdvBN in the context of semantic segmentation. The segmentation model we use is a ResNet-50 based network with dilated convolutions YYu & Koltun| (016)). We present generalization results under two scenarios: the first is from Cityscapes (Cordts al., (016) to GTAS (Richter et al.) 20166), where both datasets contain similar urban road scene imagesand have compatible label categories; the second is generalizing across traffic situations under different conditions with the Synthia video sequences dataset (Ros et al. (016). Our baseline models for both scenarios trained following the training protocol in Pan et al. 2018).
We train a baseline model on Cityscapes, which contains 2975 for training, and test the generalization performance of the model on GTA5 with 6382 images for validation. We apply AdvBN by plugging it
7

---

Under review as a conference paper at ICLR 2021
after layer conv2_3 of baseline model, and fine-tuned on Cityscapes for 20 epochs, with adversarial
training parameters T = 0.15, c = 0.4, and 4 repeats.
In table [ observe a performance gain of 8.2% in mean Io on the GTA5 dataset compared to the base- line model. The pixel accuracy also improves by 1.3%%
Table 5: Cityscapes - GTA5.
IoU (%)
Pixel Acc. (%)
Numbers on the left side of arrows denote performance on Cityscapes, and numbers on the right side of arrows denote performance on the GTAS dataset.
Baseline
72.0 + 30.6
95.3 + 68.5
AdvBN
71.5 - 38.8
95.2 - 79.8
For Synthia dataset, 900 images for training and 500 for validation. We consider two different road scene: "Highway" and "New York-like City", each one with different domain shifted variants: "dawn", "fog". "night" "spring" and "winter". We obtain our baseline models and AdvBN fine-tuned models following the same hyperparameter settings as for Cityscapes.
the left-front view images of each sub-dataset by randomly selecting
Table 6: Semantic segmentation results (mean IOU) Synthia dataset.
New York-like
Highway
Fog
Night
Spring
Winter
Dawn
Fog
Night
Spring
baseline
32.6
29.0
25.4
24.2
24.8
baseline
18.6
21.0
16.9
21.6
15.3
Highway/Dawn
AdvBN
33177
30.7
28.4
28.5
27.5
NYLike C// S/rring
AdvBN
21.6
24.2
22.2
27.2
19.8
In table we compare the mean IOU of baseline models and AdvBN fine-tuned models. We train two models on "Highway/Dawn" and "New York-like City/Spring" datasets separately and test them on the opposite road scene with different weather conditions. We can see AdvBN consistently improve the performance each train-test pairs.
6 RELATED WORK
Adversarial training Adversarial training and its variants (Goldblum et al. 2020 Madry et al. 2018
Shafahi et al.) 2019) have been widely studied for producing models that are robust to adversarial examples (Moosavi-Dezfooli et al. 2016 (Szegeyy et al.) 2014). Recent work considers adversar- ial training as data augmentation (Tsipras al.) 2019). Xie al. (2020) finds that deep features corresponding to adversarial examples have different mean and standard deviation than those corre- sponding to natural images. This work takes advantage of the distributional discrepancy improve performance on anverrrrraliall data, Our work also adopts the adversarial training framework to make models robust against other kinds of perturbations, but instead of crafting adversarial examples in image space, we craft adversarial feature distributions by perturbing feature statistics.
Robustness to distributional shifts While extensive effort has been made to improve the robustness of classifiers to adversarial examples, there are other kinds of robustness that deep neural networks must address in order for them to be reliable. Corrupted images and new domains pose major challenges to networks with standard training (Geirhos al. 2019 Hendrycks & Dietterich 2019] Wu et al. 2020). Performance degradation on these images can be attributed to shifts in data distributions (Gilmer et al.; 2018). In order to produce networks which generalize well, one common practice is to perform data augmentation (Cubuk et al.) 2019 Hendrycks et al.) 2020 Yun et al.) 2019). However, the benefits of data augmentation are largely limited by the types of augmentations used during training (Geirhos et al. 2018). Feature space augmentation (Li et al., 2020) replaces feature statistics corresponding to one sample with ones corresponding to another sample. Our work can be also considered as feature space augmentation, we instead consider a worst-case scenario in the context of feature space distributional shifts by adopting the adversarial training framework.
7 CONCLUSION
Our work studies how adversarially perturbing feature statistics simulates distributional shift in image data. We find that adversarial fine-tuning on features perturbed in this way improves robustness to data stylization and corruption without ever training auxiliary data. Training with Adversarial Batch Normalization (AdvBN) is computationally cheap and can quickly make pre- rreitraieed models less brittle. We fine-tune ResNet-50 with algorithm and surpass the performance of sfate-of-the-an art methods on both ImageNet-Instagram and promising direction for creating models that generalize well variety of domains.
Adversarial feature statistics are a
8

---

Under review as a conference paper at ICLR 2021
REFERENCES
Nils Bjorck, Carla P Gomes, Bart Selman, and Kilian Q Weinberger. Understanding batch normaliza- tion. In NIPS, 2018.
Marius Cordts, Mohamed Omran, Sebastian Ramos, Timo Rehfeld, Markus Enzweiler, Rodrigo Benenson, Uwe Franke, Stefan Roth, and Bernt Schiele. The cityscapes dataset for semantic urban scene understanding. In CVPR, 2016.
Ekin D Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoe V Le. Autoaugment:
Learning augmentation strategies from data. In CVPR, 2019.
J. Deng, W. Dong, R. Socher, L.JJ. Li, K. Li, and L. Fei-Fei. ImageNet: A Large-Scale Hierarchical Image Database. CVPRO9, 2009.
Logan Engstrom, Andrew Ilyas, Shibani Santurkar, and Dimitris Tsipras. Robustness (python library),
2019. URL/bttps: http///ttttttttttteeeeeeteeett com.tttooocoooooooooooooootoottt Mawdaaaaaaoobsstteeeeeeeee
Robert Geirhos, Carlos RM Temme, Jonas Rauber, Heiko H Schütt, Matthias Bethge, and Felix Wichmann. Generalisation in humans and deep neural networks. In NIPS, 2018.
Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix A. Wichmann, and Wieland Brendel. Imagenet-trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness. In ICLR, 2019.
Justin Gilmer, Ryan P. Adams, Ian J. Goodfellow, David Andersen, and George E. Dahl. Motivating the rules of the game for adversarial example research. CoRR, abs/1807.06732, 2018.
Micah Goldblum, Liam Fowl, Soheil Feizi, and Tom Goldstein. Adversarially robust distillation. In AAAI, 2020.
Ian J. Goodfellow. Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. CVPR, 2016.
Dan Hendrycks and Thomas G. Dietterich. Benchmarking neural network robustness to common corruptions and perturbations. In ICLR, 2019.
Dan Hendrycks, Norman Mu, Ekin Dogus Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshmi- narayanan. Augmix: A simple data processing method to improve robustness and uncertainty. In ICLR, 2020.
Xun Huang and Serge Belongie. Arbitrary style transfer in real-tim sulltimme with adaptive instance normal- ization. In ICCV, 2017.
Sergey Ioffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. In ICML, 2015.
Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In ICLR, 2017.
Boyi Li, Felix Wu, Ser-Nam Lim, Serge J. Belongie, and Kilian Q. Weinberger. On feature normal- ization and data augmentation. CoRR, abs/2002. 102, 2020.
Yanghao Li, Naiyan Wang, Jianping Shi, Jiaying Liu, and Xiaodi Hou. Revisiting batch normalization for practical domain adaptation. In ICLR Workshop, 2017.
Aleksander Madry. Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ICLR, 2018.
Seyed-Mohsen Moosavi-Dezfooll. Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In CVPR, 2016.

---

Under review as a conference paper at ICLR 2021
Xingang Pan, Ping Luo, Jianping Shi, and Xiaoou Tang. Two at once: Enhancing learning and generalization capacities via ien-net. In ECCV, 2018.
Stephan R. Richter, Vibhav Vineet, Stefan Roth, and Vladlen Koltun. Playing for data: Ground truth
from computer games. In ECCV, 2016.
German Ros, Laura Sellart, Joanna Materzynska, David Vazquez, and Antonio Lopez. The synthia dataset: A large collection of synthetic images for semantic segmentation of urban scenes. In The IEEE Conference on Computer Vision and Pattern Recognition (CVPR), June 2016.
Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry $ Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In NewrIPS, 2019.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.
Dimitris Tsipras. Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness may be odds with accuracy. In /CLR, 2019.
Dmitry Ulyanov, Andrea Vedaldi, and Victor S. Lempitsky. Instance normalization: The missing ingredient for fast stylization. CoRR,
2016.
Zhe Wu, Zuxuan Wu, Bharat Singh, and Larry S. Davis. Recognizing instagram filtered images with feature de-stylization. In AAAI, 2020.
Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L. Yuille, and Quoe V. Le. Adversarial examples improve image recognition. CVPR, 2020.
Fisher and Vladlen Koltun. Multi-scale context aggregation by dilated convolutions. ICLR, 2016.
Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy to train strong classifiers with localizable features. In ICCV, 2019.
Richard Zhang, Phillip Isola, and Alexci A Efros. Colorful image colorization. In ECCV, 2016.
10

---

Under review as a conference paper at ICLR 2021
A IMAGENET-ADVBAL EXPERIMENTS
A. CREATION OF THE MAGENET-ADVBE DATASET
We process the entire ImageNet validation set using the visualization technique introduced Section 3 We consider two encoder architectures: one is the VGG-19 encoder use for visualization, another consists of layers of a ResNet-50 up to conv2 2_. Both encoders are paired with the same decoder architecture from Huang & Belongie (017)) The resulting datasets, denoted by ImageNet-AdyBl VGG and MaageNer-AdyB--Reee for testing other models is generated using these autoencoders that contain the AdvBN module but on ImageNet validation data. AdvBN is conducted with 6 steps, stepsize = 0.20, = 1.1, and batchsize of 32. We do not shuflle the ImageNet validation data when generating these batches.
respectively, contain 50000 images each. The data we synthesize
A.2 CLASSIFICATION ON IMAGENET-ADVBN
Table 7: Classification performance on ImageNet and ImageNet-AdvBN.
ImageNet top1 acc.
Im-Adv- VGG
VGG Reconstructed topl/ top5 acc. f
Im-Adv-ResNel top1/ top5 acc.
ResNet Reconstructed topl/ top5 acc.
Method
top top5 acc.
Standard
45.8/ 70.6
0.4/ 1.3
86.9 61.2/ 83.1
PGD
62.4
15.4/ 30.2
54.7/ 77.8
1.0/ 2.2
MoEx
79.1
1,0/ 2.9
40.21 63.8
0.3/ 1.1
65.7/ 86,8
IBN-Net
77.2
2,3/ 6.2
49.2/ 73.9
0.6/ 1.9
69.4/ 89.4
AugMix
77.6
53.5/
1.0V
SIN
74.6
10.9/ 24.4
51.7/
1.7/ 4.3
67.2/ 87.9
Ours
76.5
6.3/ 15.6
54.6/ 78.3
2.9/ 6.4
66.4/ 87.3
shows the classification performance of various models on the two ImageNet-AdvBN variants, denoted Im-Adv-VGG and Ae----d--eNett respectively. We also test these models ImageNet images that are reconstructed using our autoencoders, denoted as VGG Reconstructed and ResNet Reconstructed, for each autoencoder. The performance gap between ImageNet-Advbl AdvBN and Reconstructed ImageNet indicates that the degradation on ImageNet-AdvBN is not solely caused by the reconstruction loss due to the autoencoders
Table
A.3 ADDITIONAL EXAMPLE IMAGES
We include more images from MageNet-AdvBN--Ve are randomly chosen. We do not include the ImageNet-Adv AdvBN-Resee,,,,,,. because the resulting images mostly in extreme contrast with small textures that are hard observe. It is possible that features output from ResNet based encoders are more sensitive to AdvBN perturbations; another explanation that the features we extract from Re are relatively shallow features compared to their VGG counterparts.
in this section. Example images in Figure
B RUNTIME ANALYSIS
B. RUNTIME TRAINING WITH ADVBN
We evaluate the training time of our method on workstation with GeForce RTX 2080 Ti GPUs. We use the default settings for AdvBN on ResNet-50: an AdvBN module after the conv2_3 layer, fixed AutoAugment policy, and 20 epochs of fine-tuning with 6-step PGD inside the AdvBN module. Fine-tuning is conducted on the ImageNet training set, containing 1.3 million images. Training in this setting takes approximately 40 hours with batchsize set to 256.
B.2 COMPARISON WITH OTHER METHODS CONCERNING TRAINING BUDGET
We the same infrastructure above to evaluate the training time of other ResNet-50 models that appear in Table [ Training code for all other methods are obtained from official repository. For all methods, batch size of 128, because augmix(Hendryeks al. 2020) cannot with
11

---

Under review as a conference paper at ICLR 2021
Figure 5: More example images. For each pair of adjacent columns, original versions the left, ImageNet-AdyBB-VGG is on the right.
batch size of 256 on our workstation due to limited GPU memory. The number of processes in the dataloader is set to be 16. The speed values in Table g are averaged over 100 iterations. The estimated training duration calculated by multiplying the speed and corresponding total number of iterations. Time spent on evaluation after each epoch is not considered in this estimation.
Table 8: Runtime Analysis.
Speed (seconds/ iter.)
Epochs
Estimated training duration (hours)
Model
Standard
0.17
PGD
2.95
90
738
MoEx
0.19
300
168
IBN-Net
0.22
100
61
AugMix
0.67
180
335
SIN
0.34
45
43
AdvBN
0.83
20
46
Training with AdyBN takes a long time per iteration because each iteration contains PGD steps. The SIN (Geirhos et al. 2019) runtime speed is estimated based standard training, since the model architectures and training procedures of these two methods are the same, except that SIN trained for half the epochs but twice the data and thus twice the number of iterations per epoch. Training SIN requires additional access to Imaazeee- as training data, which takes 134GB disk space; the time for generating the Stylized-ImageNet ImageNet dataset and the extra storage are not considered in Table g
C INFERENCE USING MODELS TRAINED WITH ADVBN
Models containing Batchnorm layers will have two set of BN statistics in deeper layers that have been fine-tuned by AdvBN because use auxiliary BNs introduced by (Xie et al. 2020) for propagating adversarial features crafted by the AdvBN module. During evaluation, we can choose either of the BN statistics to normalize features. The results we report in previous sections with regard to ImageNet, ImageNet-C and ImageNet-Instage to original features. We only auxiliary BNs, which keep the batch statistics of adversarial features, to test performance on Stylized Stylized-ImageNet Table [ We also use auxiliary BNs for evaluating performances IeageNet-AdvBNN and Reconstructed ImageNet in Table
are obtained by using BN statistics corresponding
12

---

Under review as a conference paper at ICLR 2021
D DETAILED RESULTS ON IMAGENET-C
In this section we provide detailed version of the results shown in Table concerning the ImageNet- C dataset, which technically contains total of 75 variants of the ImageNet dataset. The 75 variants fall into categories corruptions, each category presents 5 gradually increasing degrees of severity, where "degree=1" denotes the lowest degree of severity. From Table 9 we can see that AdvBN is
Table 9: Detailed results on ImageNet.
Noise
Blur
Weather
Digital
Network
Clean Gauss. Shot Impulsc Defocus Glass Motion Zoom Snow Frost Fog Bright Contrast Elastic Pixel JPEG mCE
Standard
23.9
80
82
83
75
89
78
80
78
75
66
57
71
85
77
77
76.7
AdviNN
Degree
Dogree
Degroe
Degroe
Model
Corruption
Coruuption
Corruption
2
3
Corruption
2 3
AdvBN
38 44 56 69 79
39 52 80 86 90 Blur-Motion
33 59 76 85 Blur-Zoom
48 59 66 73 79
Blur-Defocus
Blur-Glass
AugMix
AdvBN
Wearher-Snow
59 69 75
Weather.Fro
36 56
71
Weather.Fry Fog
33
Wenther-rright
26.27 28
AugMix
57 69 77
35
71
37 52
25
Digital- Digital-Coniras..
Digitul-Flastic
Digital-Pise
32.33
Digital-PPRG
AugMix
29 33 39 59 85
31 53 37 48 71
30:32.41 60
32:35 37 52
AdvBN
AugMix
Noise-
32 40 55 76 94
35 45-42.55 54 69 86
Noise-Shot
35:43 71 82
33 77 88
Noise-Tmpulse
40 55
36 46 56 79
capable improving the baseline model on almost all corruption types, except for the "zoom blur". By looking into the bottom table where we compare to the AugMix method in detail, we can see that AdvBN can achieve comparable results with AugMix specifically on subcategories of "Weather" and "Noise", where it outperforms AugMix under more severe corruptions.
E
MORE ABLATION STUDIES
We enclose more ablation studies in the appendix.
Table 10: More ablation studies.
ImageNet topl acc.
ImageNet-C
ImageNet-Ins. topl f
ImageNet-Styl. top1 acc. 1
Model
Standard
76.1
76.7
67.2
7.4
multiplicative 6
76.5
68.6
71.1
14.1
additive
75.9
69.4
70.2
13.7
0.5
76.5
69.4
70.8
14.4
1.5
75.5
68.5
71.1
14.1
2.0
71.1
AdvBN"
77.0
72.6
69.5
11.9
Multiplicative vs. additive perturbations. We originally chose multiplicative noise so that single perturbation bound can applied to various layers and architectures regardless of the range in which feature values lie. To adjust the perturbation bound for an additive noise for each batch of feature, we compute maximum mean and standard deviation values across channels, Amar and Oman- Then, in the projection step of the PGD attack, we project perturbations to the mean and standard deviation into the ranges (-c- Pmazz c. (maz) and (-c Omaz, c Tmaz)) respectively. The model is denoted "additive 8" in Table 10 This variant results in slightly degraded accuracy each dataset, but notice that we use the same hyperparameter setting as the multiplicative case, and there possible better settings for the additive case.
13

---

Under review as a conference paper at ICLR 2021
Weighted adversarial loss Note that in Algorithm [ our final objective is equally weighted combination clean loss and adversarial loss. It is possible that there are better way to combine the two term. In this section, try adding a weigh the adversarial loss, and see how the performance would be affected by it. That is, we now run the last step in Algorithm by:
0 t arg min (- 11, (Fado); v) + C(go ++ (f).
(6)
We try y with range of values [0.5, 1.5, 2.0] for this ablation study, adn the results are shown in Table 10
Standalone AdvBN In section 5.1 we propose to train AdvBN with a set of more sophisticated augmentation operations than standard ImageNet augmentation, which is proposed by auto aug- mentation(Cubuk et al. 2019) as the optimal set of data augmentation for the task of ImageNet classification. Therefore, the presented performance gain actually comes from both the image space data augmentation and AdvBN. The results prove that AdvBN, data augmentation approaches, can be combined with and further improve these approached. order to see the effectiveness of the standalone AdyBN method, with only basic ImageNet augmentations (random resized cropping and random flipping). The result for standalone AdvBN is denoted "AdvBN"" in Table T0 We the same hyperparameter setting for this result as we use for the "AdyBN + auto augmentation" experiment, and it is likely not the optimal setting.
method orthogonal to image space
provide results of training AdvBN
14


Reviews:
[{"review_id": "aqe8CZjV0Gd", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper introduces a method for improving robustness of neural networks to domain shifts by adversarially perturbing the feature statistics. This is a very interesting idea, by playing a middle ground between the worst case of PGD and not doing anything. My main problem about the paper is the evaluation and particularly the lack of evaluation of certain models and certain datasets.  \nLets talk models first. It is unclear to me why the quite related AdvProp model is not evaluated here. Even if they are difficult to train the pre-trained models are available here: https://github.com/rwightman/pytorch-image-models. Same with the Noisy Student L2 model which doesn't have any sort of adversarially perturbation and performs much better on ImageNet-C than the best number reported here. For reference pretrained weights for both model types are available in the above link. With the availability of pretrained models it seems inexcusable to only have 5 arbitrary comparison points, especially when there are models with significantly better accuracy.  \n\nFurthermore, for stylized ImageNet and Instagram I would like to see what a resnet50 simply fine-tuned on those distributions look like. \n\nNext on the distribution shift side, I'd also like to see more than just 3 distribution shifts. There have been two recent papers that do a metastudy of many distribution shifts: https://arxiv.org/abs/2007.08558 and https://arxiv.org/abs/2007.00644. A thorough evaluation on other distribution shifts can give a more complete picture of the advantage of the proposed approach to distribution shift rather than just 3 numbers out of context.\n\nFor these reasons I recommend rejection.\n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "WgtjiBvLRfi", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes an algorithm for generalization to unseen domains. The algorithm performs adversarial training on the batch normalization coefficients. The authors provides experimental results showing the benefits of the proposed algorithm and also provides ablation study.\n\nStrength:\nI think the algorithm in this paper is simple and straightforward and the paper is easy to follow. The authors provided experiments on large scale dataset, some ImageNet-based datasets.\n\nWeakness:\nMy major concern is that the experimental results does not fully validate the effectiveness of the proposed algorithm. For example, in Table 1, the results are very close to Augmix on Imagenet-C and Imagenet-Instagram. Only on Stylized-Imagenet, the proposed method shows benefits.\nI have a hypothesis that the proposed AdvBN method may bias the model to be more robust to image style change (the images in Figure 2 and 3 kind of show this), but may not improve the robustness to other types of corruptions. Overall, it is not convincing that the proposed method can provide universal robustness gain to all kinds of corruption/domain changes.\n\nRecommendations:\nI would like to see more discussion on how the proposed algorithm affects different types of corruptions.  For example, there are 15 different types of image corruptions in Imagenet-C, and I suggest the authors to provide the test results on each type of corruption, so that the readers can better understand what types of corruption this method is more effective on.\nIf the authors cannot show that AdvBN provides universal robustness, I would like to suggest that the authors change the claims in the paper that the AdvBN improves the robustness to all the corruptions (or preparing for the worst), to a more gentle claim that the method is effective for some particular types of corruptions.\nIf possible, I would also like to see some experimental comparison between this method and distributional robust optimization, which I think is a more principled approach to getting general robustness. For example, can the authors compare with:\nVolpi, et al, Generalizing to Unseen Domains via Adversarial Data Augmentation?\n\n\n=======\n\nAfter author response: I would like to thank the authors for providing the details of each corruption in ImageNet-C dataset. I understand that it might be hard to compare with Volpi et al due to lack of implementation details. However, I still feel that this submission is a bit lack of depth and thus it may not be a good contribution to the ICLR community. I would like to see more theoretical or experimental evidence that can help us get a deeper understanding of this approach. Overall I decided to keep my score.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "V1VXCJEVdLR", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes adversarial batch normalization (ABN) to perturb feature statistics. It is to makes CNNs more robust to image style or appearance changes. An ABN layer can plug into the middle of a CNN to finetune a pre-trained model. The CNN layers after the ABN layer can learn more robust representations from the perturbed features. It uses two groups of batch normalizations in the later layers: one for the adversarial features and the other for clean features. Experiments show it can improve robustness on image classification and segmentation.\n\nPros\n1. Applying adversarial training to batch normalization statistics is well-motivated for image style robustness.\n2. The method looks simple to implement.\n3. Experiments show its effectiveness on two tasks: classification and segmentation.\n\nCons\n1. Some typos exist in the paper, e.g., \"additional compute\" and \"training times\" in the last paragraph of Section 4.\n2. The meaning of the last line in Table 2 is not clear. I have read the paragraph describing this ablation study (AutoAugment*) but still do not understand it. Does it mean ABN in Table 1 is with AutoAugment during the finetuning?\n3. It is not clear whether ABN applies in conjunction with AugMix to further lower the corruption error. The current corruption error is close to AugMix.\n4. Experiments only use one model, ResNet-50, which is insufficient. The layer ablation study does not explore the first network block and input. It is not clear whether the optimal layer changes if the network architecture changes.\n5. The domain generalization setting from Cityscapes to GTA5 is unconvincing because Cityscapes are realistic data, while GTA5 consists of synthetic data. The opposite generalization makes more sense in practice.\n6. The paper emphasizes the finetuning efficiency when compared with other methods trained from scratch. I think the pre-trained time also needs to be considered. For a new task, there is usually no well-known pre-trained models. This raises another question: how does the method perform to train a model from scratch?\n\nIn summary, the proposed ABN is simple and effective in improving model robustness to style changes. My main concern is that the experiments are insufficient and have some space for improvements. See points 2-6 in the above for details. Thus, I tend to rate it below the acceptance threshold.\n\nPost-rebuttal updates\n\nThank the authors for the great efforts in addressing the concerns. The new experiments on two new backbones DenseNet-121 and EfficientNet-B0 show the method can work well with multiple backbones, which is good. However, my other concerns remain unsolved. \n\n1. Combination with AugMix seems necessary to demonstrate state-of-the-art performance and its orthogonality. \n\n2. I still think the generalization from GTA5 -> CityScape should be listed together with CityScape -> GTA5. \n\n3. The running time comparison should take the model's pre-trained time into account in Table 8.\n\n4. Regarding the blocks in the ablation study, I remember a ResNet50 for ImageNet has 4 blocks. Table 3 only lists 3 blocks (2,3,4). So the first block is not the first convolution layer. \n\nTherefore, I still keep my original rating.", "extra_scores": {}, "extra_text": {}}, {"review_id": "NbWVm8zxbfD", "reviewer": "AnonReviewer5", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "**Summary:**\nThe paper proposes a new adversarial training procedure that finds worst-case batch normalization (BN) parameters in some Linf-ball around the identity BN parameters. The authors show that this approach combined with AutoAugment significantly improves the accuracy on challenging datasets with domain shifts like ImageNet-C, Stylized Image-Net, and ImageNet-Instagram. Moreover, the authors show improved results on a semantic segmentation task. However, some experimental details presented in the paper require a further clarification.\n\n**Pros:**\n- The approach consistently improves on different datasets that measure robustness towards domain shifts (ImageNet-C, ImageNet Instagram, Stylized ImageNet).\n- The approach doesn’t require any extra data (labeled or unlabeled).\n- The approach also leads to better results for semantic segmentation.\n\n**Cons:**\n- Misleading presentation of the AdvBN results. In particular, in Table 1, “AdvBN” rather refers to “AdvBN + AutoAugment”. But it’s clear that adding AutoAugment to any other competing method would also improve them. Thus, one has to separately report results for “AdvBN (without AutoAugment)” and “AdvBN + AutoAugment” to allow a clearer comparison. Table 2 shows the results of *AutoAugment alone* (and apparently, there is a benefit of combining AutoAugment with AdvBN), but what one really needs to know is the performance of *AdvBN alone*.\n- Comparison to Lp PGD training is incomplete. First of all, it’s not specified which model was used (L2- or Linf-trained and under which epsilon). Second, one should always do a grid search over the Lp-epsilon similarly as you did for the proposed AdvBN method in Table 2, and to report the best model. Otherwise it’s not even clear whether the proposed AdvBN method is better than standard Lp PGD training. Any Lp-robust models from Engstrom et al. (2019) is clearly suboptimal for the tasks considered in this paper since these models have much lower clean accuracy. \n- I couldn’t find a discussion on this, so I assume you used AutoAugment with **all** its data augmentations including those that are present in ImageNet-C. If it’s true, then the comparison to AugMix is unfair as in their method they have removed all overlapping corruptions.\n- This is a very important detail that should’ve been clearly discussed in the main part and not just in the appendix: *“The results we report in previous sections with regard to ImageNet, ImageNet-C and ImageNet-Instagram are obtained by using BN statistics corresponding to original features. We only use auxiliary BNs, which keep the batch statistics of adversarial features, to test performance on Stylized-ImageNet in Table 1.”*\nAnd then I’m not sure what the results in Table 1 for AdvBN+AutoAugment tell us: that there exist 2 models obtained via AdvBN, and one of them is good on one domain shift, and another is good on another one? But how do you know at test time which of the 2 models to apply? \n- The paper has multiple mistakes in the presentation of the proposed method: \n    - Equation (4): maximization over the BN parameters is missing. It’s written that: *“This optimization problem contains a maximization problem inside the BNadv layer.”* But I don’t see how it can be true since the maximization should be done in front of the loss. Moreover, the expectation in Eq. (4) should be taken not with respect to pairs $(x, y) \\sim D$, but rather with respect to batches $(x_i, y_i)_{i=1}^B$ to reflect the fact that adversarial BN introduces the dependency of the perturbation set on the sampled batch of points.\n    - Algorithm 1 has multiple mistakes: (1) an additional loop over batches is missing, (2) not clear how $\\delta_\\mu$ and $\\delta_\\sigma$ are initialized, (3) *“Minimize the total loss w.r.t. network parameter”* -- argmin there seems to be inappropriate, I think what was rather meant is doing *one* step of gradient descent wrt $\\theta$, (4) in the same place: there should be a clear distinction regarding when the loss is taken wrt a single data point, and when wrt a batch of points (this is particularly important since AdvBN introduces the dependency of the perturbation set on the batch).\n\n**Suggestions:**\n- First paragraph of Intro: what you refer to as “adversarial training” would be better to call specifically “Lp adversarial training”: *“While adversarial training makes networks robust to adversarial perturbations, it does not address other forms of brittleness that plague vision systems.”* \nBecause what you propose is also adversarial training but just with respect to a different perturbation set, and I assume you suggest that it does “address some other forms of brittleness”.\n- *“Additionally, note that this module acts on a per-batch basis so that features corresponding to an individual image may be perturbed differently depending on the batch the image is in.”*\nFor me it sounds a bit strange that the perturbation set that you aim to be robust against depends on the current batch of images. I wonder if some batch-independent normalization schemes can be applied here with equal success?\n- Equation (4): equal weights for both terms may be suboptimal. Thus, it would be good to include the weighting coefficient between the two terms of the objective in the ablation study.\n- Table 2: the ablation regarding where to put the AdvBN layer is inconclusive since it had to be done with respect to different epsilons. It seems that the selected epsilon was just too high for conv3_4 and conv4_6 since the clean accuracy becomes worse than that of the standard model. The same also applies to “additive $\\delta$”, it’s not clear what a single number tells us, there should be a grid search over the epsilon.\n\n**Score:**\n5/10. The paper proposes an interesting approach that can help to improve robustness towards domain shifts without requiring any extra data. I would be willing to increase the score if the paper improves its experimental part, in particular by properly reporting the results of AdvBN (see **Cons**) and its baselines.", "extra_scores": {}, "extra_text": {}}, {"review_id": "M5WNIwUqrn", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors present an approach for tackling the generalization problem in neural network classifiers based on a new method of batch normalization.  The authors go on to apply this normalization in an autoencoder arrangement in order to show the relationship between the effect of the normalizer on the features and the image that they represent.  Finally, the method is evaluated by pre-training on imagenet, finetuning with the proposed batch normalization, and testing on three versions of imagenet with global transformations applied.  \n\nPros: \nNovel application of normalization idea\nClear presentation \nUseful and relevant to the conference\nVery good quantity and relevance of experimentation \n\nCons: \nWould like to see more introspection on the results \n\nAll in all, I think this is a strong paper with only minor issues and would be a great addition to ICLR.  The idea presented is simple but also seemingly very strong in principle and I appreciate that it does not require much in the way of algorithmically complex calculations.  I am most happy about the presented level of experimentation which the authors have done a good job of a) contrasting to the state of the art, b) exploring their own model, and c) exploring other applications.  On that note, however, to explain more the “con” which I have listed, the main contribution here being the experimentation which proves the authors’ idea it would be very nice to have a discussion about what the results mean deeper than answering, “Does this prove the method?” either in the main paper or an appendix.  I have some examples listed below.  That to me would be something that could elevate the paper to the top 50% or more of papers.\n\nQuestions for the authors: \nWhy is AdvBN not improving on AugMix for imagenet-c but does for the other datasets does this indicate some drawbacks for the method?  \nWhy does performance appear to get better in the ablation study on $\\epsilon$ but then get worse after a certain threshold? \n\nPost-rebuttal updates:\nI thank the Authors for their response. After reading all the reviews and comments I feel that there are aspects of the proposed approach that are not fully understood, despite the improvements. For example, those related to AugMix, and providing fully symmetric comparisons between Cityscapes and GTA5, as several reviewers have pointed out. For these reasons, I have decided to revise my ratings as I also recognize the importance of these observations. ", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This work proposes a novel, interesting and simple technique to improve the model robustness to distribution shift. The proposed method is called Adversarial Batch Normalization (AdvBN) which is based on adversarial perturbation of BN statistics. Authors provide extensive experiments to show the effectiveness of AdvBN. All reviewers agree that the proposed method is interesting and novel. The main concern of reviewers is about the some of the details of the empirical evaluation of the proposed methods which makes its effectiveness less clear. In particular, the following concerns are shared among the reviewers:

1- Authors give different treatments to Stylized-ImageNet compare to other tasks by using auxiliary BN at inference time instead of standard BN and further results provided by authors show that the improvement over previous methods disappear if they use standard BN for inference on Stylized-ImageNet. I think authors could mitigate this issue by further investigation or providing a better explanation on why they have a different treatment for Stylized-ImageNet (other than the fact that auxiliary BN has a better performance on that task). The other potential remedy is to come up with an automatic way to decide which one to use at the inference time using a batch of "unlabeled" validation data.

2- The improvement of AdvBN over AugMix and AdvProp (which was added during the rebuttal) is not clear. In particular, both methods improve over AdvBN on ImageNet-C. If standard BN is used for AdvBN on Stylized-ImageNet, then both AugMix and AdvProp improve over AdvBN. That only leaves ImageNet-Instagram as an ImageNet variant where AdvBN shows a clear improvement over AdvBN and AugMix. A potential solution is to try combining AugMix and AdvBN (not sure if AdvProp could be combined effectively) to see if there is a way to get maximum benefit out of these methods.

3- The empirical section could be improved by doing experiments in a systematic way. That is for any choices made in the experiment design, there should be a reason that is explained clearly. For example: 1) applying the same type of data-augmentation on all methods (or reporting all methods with and without data-augmentation). 2) compare to all baselines on ResNet-50 and then pick the top 2 baselines (say AugMix and AdvProp) and then compare them on DenseNet and EfficientNet. 3) comparing with the same baselines as (2) on the segmentation task.

Finally, I want to thank authors for engaging with reviewers, running many experiments during the rebuttal period and updating the paper accordingly. I also want to reassure authors that my final evaluation of the paper is based on: 1) reading all reviews and responses 2) weighing the reviews based on their substance, quality and engagement of reviewers 3) looking at the initial and final revision of the paper. In particular, even though the average score of this paper is low, in my opinion it is a borderline paper. After taking all of the above into account, my decision is to recommend rejection. Even though the proposed method is very interesting, there are three clear valid concerns all of which can be addressed as I suggested above. Without addressing those concerns, the empirical advantage of the proposed method is not demonstrated properly. I think after addressing those concerns this paper will be in a much better shape, more useful for ML community and hence receives the attention it deserves. I sympathize with authors that their efforts during the rebuttal period did not result in improving reviewers' scores but I want to emphasize that I did take all those updates into account when making my recommendation for this paper.

Decision: Reject