Adversarially Perturbed Batch Normalization: A Simple Way to Improve Image Recognition
Authors: You Huang
Hong Liu
Xiaoshuai Sun
Xiaopeng Hong
Xianming Lin
YONGJIAN WU
Rongrong Ji
Venue: NeurIPS 2022 Submitted (2022)
Keywords: Adversarial Training
Image Recognition
Batch Normalization
Robustness
Generalization

Abstract: Recently, it has been shown that adversarial training (AT) by injecting adversarial samples can improve the quality of recognition. However, the existing AT methods suffer from the performance degradation on the benign samples, leading to a gap between robustness and generalization. We argue that this gap is caused by the inaccurate estimation of the Batch Normalization (BN) layer, due to the distributional discrepancy between the training and test set. To bridge this gap, this paper identifies the adversarial robustness against the indispensable noise in BN statistics. In particular, we proposed a novel strategy that adversarially perturbs the BN layer, termed ARAPT. The ARAPT leverages the gradients to shift BN statistics and helps models resist the shifted statistics to enhance robustness to noise. Then, we introduce ARAPT into a new paradigm of AT called model-based AT, which strengthens models' tolerance to noise in BN. Experiments indicate that the APART can improve model generalization, leading to significant improvements in accuracy on benchmarks like CIFAR-10, CIFAR-100, Tiny-ImageNet, and ImageNet.

Xie et al. 11 challenges the widely accepted idea that AT hurts models' generalization. They 23 proposed adversarial propagation (AdvProp) to exploit the adversarial features via auxiliary Batch Adversarially Perturbed Batch Normalization: A Simple Way to Improve Image Recognition
Anonymous Author(s)
Affiliation
Address
email
Abstract
Recently, it has been shown that adversarial training (AT) by injecting adversarial samples can improve the quality of recognition. However, the cxisting AT methods suffer from the performance degradation on the benign samples, leading to a gap between robustness and generalization. We argue that this gap is caused by the inaccurate estimation of the Batch Normalization (BN) layer, due the distributional discrepancy between the training and test set. To bridge this gap, this paper identifies the adversarial robustness against the indispensable noise in BN statistics. In particular, we proposed a novel strategy that adversarially perturbs the BN layer, termed ARAPT. The ARAPT leverages the gradients to shift BN statistics and helps models resist the shifted statistics to enhance robustness to noise. Then, we introduce ARAPT into a new paradigm of AT called model-based AT, which strengthens models' tolerance noise in BN. Experiments indicate that the APART can improve model generalization, leading to significant improvements in accuracy and ImageNet.
2
10
11
14
on benchmarks like CIFAR-10, CIFAR- 100,
Introduction
16
show that deep neural networks are sensitive to adversarial perturbations, which gives rise to the rapid development of adversarial training (AT) methods 5 methods enhance models' robustness against adversarial samples by solving a min-max optimization
Recent works 1
3
17
These AT
18
19 problem (5). However, many efforts [6] 9 [0] have corroborated that there is trade-off between
20 standard and robust accuracy, in which AT usually degrades models' performance on benign samples, though they enjoy the accuracy gains adversarial samples.
21
24 Normalization (BN) [12 layers. However, the huge computational overhead discourages more efforts
25 its applications. Thus, the further work proposed fast AdvProp [13] reduce the computations by
26 leveraging the acceleration of AT [4]. Nevertheless, leveraging adversarial samples to perform AT
27 in non-safety tasks leads to the following question:
What does the model defend against?
29 Indeed, adversarially trained models appear closely tied to the robustness against adversarial attacks for safety concerns. However, in non-safety situations, there is an open question of what these 31 models defend against. This question is essentially related to the gap between models' generalization reposition the adversarial robustness as the
32 and adversarial robustness. Prior efforts
[5
16
17
Submitted to 36th Conference Neural Information Processing Systems (NeurIPS 2022). Do distribute.

---

33
robustness against the worst-case unseen domains, in attempts to bridge the cawpalliizationoobuuuttttee
34 gap. They usually enhance models' robustness to adversarially generated domains to improve the generalization. Nonetheless, there is inevitably a mismatch between such generated domains and the actual domains. The mismatch hinders their further applications.
35
36
In this paper, answer this question by identifying the robustness against the noise of BN statistics that are the estimated mean and variance. The statistics noise is indispensable due to the distributional Moreover, insufficient batch
38
39
discrepancy between training and test domains [8] 19 20 21 22 23
40
size will cause the severer noise in some computaaion-demanddie
tasks 18
20 In this study, we
41
cast the statistics noise as a numerical problem to avoid the issue how to match the adversarially
42
generated domains with the actual ones. Since the noise degrades BN's performance, numerically strengthening models' tolerance such noise will boost the generalization of BN-based models.
43
44
In this work, we train models by Adversarially Perturbed bAtch noRmalizaTion (APART) that perturbs BN statistics and updates the model parameters to resist the perturbation on the fly. More concretely. APART performs backward passes twice over each batch of benign samples. The first backward pass produces two gradient computations: one normal gradient that helps update parameters of model w.r.f. samples' patterns, and the other one statistics gradient that is used to perturb the statistics parameters in BN. Then, the second pass is performed to generate the defensive gradient that helps the model resist the adversarial statistics perturbation. The normal and defensive gradients are combined to improve both generalization and robustness of the model. All gradients are computed by the regular gradient descent algorithm. Note that APART combines the normal gradient with the defensive one without changing the update strategy and without crafting the adversarial
45
46
47
48
51
52
59
54 samples. This process follows a paradigm of AT performing attacks and defense within models
55 instead of on samples, hence the name model-based AT. Besides, as suggested by AdvProp [1. the BN statistics computed over the adversarial passes are dropped avoid the corruption.
56
57 Experimentally, APART makes models less brittle to noisy BN statistics. As consequence, the mod-
58 els enjoy significant accuracy gains on CIFAR (24). Tiny-ImageNet (25) and ImageNet (26) datasets. Moreover, the improvement brought by APART only depends on BN, allowing the combination with other training methods, e-g. data augmentation 27 and sharpness-aware minimization 28
59
60
Summary of contributions:
62
We identify the adversarial robustness against the noise in BN statistics to bridge the gap between models' generalization and robustness. Enhancing such robustness by AT improves models' generalization on benign samples.
63
64
85
We proposed APART to achieve the robustness against the statistics noise. APART follows new paradigm of AT utilizing the gradients efficiently. By strengthening BN-based models' tolerance to BN statistics noise, APART significantly improves the models' performance.
66
67
68
With its plug-and-play nature, APART allows the combination with other training methods and enjoys the further accuracy gains.
89
2
Related Work
70
71
2.1 Adversarial Training
Adversarial training (AT) 1 29 is empirically demonstrated to be one of the most effective
73 defense methods for models' safety concerns. Instead, many non-AT methods [30 31
32
33)
fail
74 to defend against adaptive attacks 4 However, AT sacrifices the standard accuracy on benign
75 samples to increase models' robustness [9] Thus, there is a trade-off between the robustness and
37 theoretically and experimentally 77 corroborate the difficulty of achieving adversarial robustness over limited data. Besides adversarial [38 [4] focus on the efficiency of AT due to the high computational overhead [5] 6). The proposed fast AT method [4] accelerates the training in
76 generalization 66) Furthermore, many efforts
robustness, other works
of vanilla AT methods

---

80
simple way, but suffers from catastrophic overfitting 33 40 This problem gives rise to more
81
efforts 39
82
Besides performing AT over samples, Adversarial Weight Perturbation
g additionally perturbs
83
parameters to enhance the generalization from perspective of loss landscape. In non-safety tasks, 44 45 have been devoted to such parameter-basee AT and show promise in improving models' generalization. In this study, the proposed method follows more generic paradigm of AT that allows the attacks on each component of models even including the non -on-marameter BN statistics.
84
some efforts [28 4
85
86
87
88
2.2
Adversarial Robustness Beyond Safety
89
Though the disadvantage of AT in models' generalization discourages the efforts of its non non-safety applications, Xie et al. [11] proposed AdvProp challenge this issue. AdvProp utilizes auxiliary
90
91
BN layers to avoid corrupting the BN statisties estimated over benign samples. In this manner,
AdvProp improves models' generalization and inspires the further studies [46] 16 15
48 49
93
of the adversarial robustmess beyond safety. Indeed, AT provides the framework of crafting and countering the worse-case unseen domains [1] 16 17), and enhances adversarial robustness varying
94
95
different contexts. Besides, Mei et al. 13 utilize the acceleration of fast AT 14 to significantly
96
reduce the computational overhead of AdvProp [11]
In this work, the proposed AT method, termed APART, increases models' robustness against the noise of BN statistics. Though the perturbation formula of the statistics is somewhat similar to that of Adversarial Batch Normalization (AdvBN) [15], there are three major differences between them in implementations: 1) APART perturbs the entire network by slightly changing each BN layer, instead of perturbing the features generated from a specific non-BN layer [5]; 2) in each iteration, APART performs backward passes only twice to carry out the attack and defense efficiently, instead of performing multiple backward passes inefficiently [15); 3) APART trains each model from the scratch, instead of fine-tuning pre-trained model [5). which leads to incomparability between
98
89
100
101
102
103
APART and AdvBN.
106
2.3
Normalization
107
Batch Normalization (BN) 12 has successfully boosted a broad range of deep neural networks by accelerating the training. However, the noisy statistics of BN degrade its performance experimen- [50] Many efforts have been devoted to more accurate estimators of the
108
109
tally 20 and theoretically
110
22 23 Some estimators perform the normalization along different axes, e.g. Layer Normalization [18), Instance Normalization [19] and Group Normalization [20]. They reduce the noise in the case of tiny batch but suffer from performance degradation under large batch as the alternative to BN. More efforts [21 215515 52 [6] exploit the combination of these normalization methods. They selectively use the spis-specific statistics to perform normalization in response to different domains. Additionally, the on-the-fly estimation of BN statistics over adversarial samples is
statisties 18
19
20
21
112
113
114
115
116
experimentally found to have negative impacts on the standard accuracy [1 53). This finding leads to more exploration in BN under AT
117
49
118
The noisy statistics result from a mismatch between the seen and unseen domains and are therefore indispensable without the domain-specific knowledge. Furthermore, tiny batch size caused by the tasks results in the severer noise. From an opposite perspective of these methods denoising the statistics, our method hardens BN-based models' robustness against the noise.
119
120
computation-demaate
121
Method
122
123
In this section, we firstly introduce a new paradigm of AT that allows us to perform attacks and defense within models rather than on samples. Then, we propose APART to implement this paradigm in simple way. Finally, discuss the enhancement of APART, which is derived from the potential link between APART and the other training method.
124
3

---

127
3.1
Model-Based Adversarial Training
128
The vanilla AT formulates a min-max game [ by adversarially crafting and defensively countering the imperceptible perturbations to samples. Specifically, given the ground truth y and sample æ's allowed neighborhood S(x)), we minimize the expectation of 0 e-parameterized loss C(x", y: 0)
129
130
with x² S(x) maximizing L(: y; 0), i.e.,
min (x,""(x" y; 0); where x == argmax L(x', y; 0). xr e'E)(w)
(1)
0
132
Empirically, the maximization of Eq. T is achieved by a gradient ascent method for each sample. The gradient VzL( y; 0) is iteratively computed by full forward and backward passes on the model. This process merely requires the inputs' gradients VzL(æ, y; 0) and drops all the internal gradients (ar y: ()) without their further utilization after finishing the backward pass. Thus, such vanilla AT suffers from low efficiency of utilizing the gradients. Meanwhile, AT's potency is limited by such sample- based attacks and defense. Therefore, we propose a paradigm of model- based AT to leverage internal gradients efficiently and allow the attacks and defense within models.
135
134
135
137
138
139
To perform such AT, each component of model categorized into two types: one for the attacker, and one for the defender. Denoting by 0, the parameters of the adversarial and defensive components respectively, we formulate the model-based AT as follows
140
min y(x Rax y: () + max L(x, y: 0, (b)
(2)
OE
142
where θ is a parameter space that can be bounded to avoid trivial results; R(x, y:: Φ) is a task- specific loss allowing models to learn the normal patterns in samples, and L(x, y: 0, Φ) can share
143
144
a similar formulation of to enable more pattern exploration in an adversarial manner. Overall,
145
Eq. 2 provides generic formulation of model-based AT. For example, Generative Adversarial Networks (GANs) [54] can be repositioned as special case of such AT, in which the generator and discriminator are regarded as the attacker and defender respectively, and the discriminative losses are cast as proper R and L in Eq. 2 Next, we introduce APART to implement this model-based AT in a simple way.
148
149
150
3.2
Adversarially Perturbed Batch Normalization
151
Model-based AT helps models harden their robustness against a specific problem. We shift our attention to the noisy BN statistics (2)). and apply the proposed AT to address this problem.
152
153
Firstly, we embed two temporary parameters 8n, 6, into each BN layer as the adversarial parameters θ in Eq. (2), which will be dropped after the training. Inspired by AdvBN (15), with 8ير, d_ t- 0, we reformulate the BN mapping as
155
(1+ 8 +3,
BN (N(:; 6,, -((1+
156
where each operator is clement-wise; p,, & are the mean and standard deviation estimated over a batch of x respectively; 7. B are the parameters of BN's affine mapping. We bound the d-dimensional 5n. 5e such that 5,, 8 E c[- for small sufficient perturbation radius > The bound avoids O. Now all the other trainable parameters within the entire model including 7, G are naturally the defensive parameters &. The losses R, L in Eq.
157
158
159
trivial results, e.g. BN(x; 6,z, 6-)18__--
161
both the same task-specifie loss, i.e., the cross entropy in recognition. Therefore, Eq. 3 implies (0 indicates all BN layers' ōμ ),)
162
[(x, y: 0, +))0==0 = ((x
VoL(z, y: 0 = V & y:
(4)
163
by which we can get both VoL(æ, y; O, Φ) and &o yr () in a single backward pass with f(x y: 0, <))o= as the loss.
184
165
Secondly, we propose APART that follows gradient accumulation strategy, instead of the alternative
update strategy used by GANs [54]. Specifically, in each iteration of normal gradient descent algorithm over a batch of samples D == ((x, y.), S sis M).

---

Algorithm 1: Pscudo code of APART getting the gradient for a batch of samples, given some perturbation radius e, number of samples in the second pass N, and group number n
Data: A batch of samples D == {(m;, Vc), Σ
M)
Result: The gradient g for this batch of samples
0 <-0 0
2 Perform forward and backward passes once over D, generating 9e and I& simultaneously (ff(a a, yı Φ)le=
3
De +- E(a,
9 < L(..)DD V R ,, Ye:
5 4 esign(ge)
Randomly draw N samples S C
7 Group into n equally sized subsets St, S2,...,,,
he f-0
9 for j f to n do
h& < he 1 n DE,,,),,,, Vo ys: ()
10
end
12 f- M+ + M4Nho he
168
Step 1: With + O, APART performs the forward and backward passes once over this batch of samples to generate the gradients w.r.f. the adversarial and defensive parameters, i.e., Do = (...,)) D.o....eeooor.. VoC(x, ye; 9. x)) o= and 9 := (.) V& Yr; Φ) according to Eq. 4. Like Fast Gradient Sign Method 22] APART uses esign(ge) to assign O, which empirically performs the inner maximization of Eq. and generates the adversarially perturbed statistics in each BN layer.
169
170
171
173
174
Step 2: With the adversarial BN statistics, APART performs the forward and backward passes again, over a full/incomplete batch of the same samples S S DD This backward pass yields the gradient resisting the attack, i.e., h& := E, VaLCaa, y () @=ssign(g)) The
175
176
177
weighted gradient g (1 r)g rhe is finally used in the outer minimization of Eq. 2 for this batch of samples, where r E [0, 0.5) re-balances the gradients.
179
Apparently, using a full batch of the samples in the second pass leads to the best performance, but results in more computational overhead. Instead, using the incomplete batch of these samples allows the less computation but suffers from insufficient defense against the attack. Thus, the ratio (/ N) is introduced to re-balance the gradients with N = [S] the number of the samples used in the second pass. Additionally, the on-the-fly BN statistics estimated in the second pass completely dropped to avoid corrupting the statistics at inference, like the auxiliary BN layers [II].
180
181
182
184
185
Note that stronger attacks in AT indirectly enhance the adversarial robustness S Thus, we slightly modify the process of the second pass to strengthen the attack. The modification increases the noise in the adversarial BN statistics without additional computation. In details, we group the samples into equally sized sets and stop their group-to- goorrouu communications in BN layers during the second forward pass. This is inspired by the fact that smaller batch size results in larger noise in the statistics. In this manner, the BN statistics are estimated over less samples without reducing the entire batch size, giving rise to the less adversarial accuracy.
186
187
190
181
192
Overall, APART only changes the way of getting gradients in each iteration, without involving in data augmentation or network modification. Therefore, APART has plug-and-pla nature that allows the combination with broad range of training methods. We summarize APART in Algorithm and then introduce the enhancement of APART.
193
196
3.3 Enhancement by Combination with Sharpness-Aware Minimization
197 Besides APART, Sharpness-Awar Minimization (SAM) 28 also belongs to and use the proposed
model-based AT paradigm. SAM improves network training from perspective of loss landscape relating to models' generalization. Given the empirical loss function Lp estimated over dataset D,
5

---

200
SAM minimizes LD with a sharpness measure:
X
min max _|
LD(w + +0) -LD(w) + LD (D(w) + w h
(5)
201
where w is the model's trainable parameters; p> is small sufficient to restrict the perturbation
202
6; À O is used to control the regularizer ||20| [2: the term in the square bracket measures Cp's
sharpness. Obviously, Eq. is equivalent
203
min max LD(w 8) 1
(6)
w ||8
204
Actually, 6 performs the model-based AT formulated by Eq. 22 in which we treat ö, w as the adversarial and defensive parameters 0, & respectively, and let f(x, y; 0 Φ) Ld(w 6). R(x, y: Φ) with the regularizer う 21[w|12 included in the empirical optimization. Therefore.
205
208
SAM and APART essentially share the same training paradigm. Surprisingly, these two methods implement this paradigm in a complementary way: SAM focuses on the trainable parameters optimized by gradient descent, while APART concentrates on the non-traine non-trainable BN statistics requiring estimation instead of optimization. The training paradigm enables them to enhance models' robustness in different contexts, which inspires a combination of them.
209
210
211
212
Note that the inner maximization in Eq. 6 is approximately achieved by one-step gradient ascent. Then, the outer minimization is performed by estimating the gradient w.r.f. the adversarially shifted parameters w <- w+6 (28). Thus, SAM shares similar two-step strategy of APART. Such similarity allows us to perform APART and SAM simultaneously by a slight modification of Algorithm [ termed APART-SAM. Specifically, we adopt the weights' perturbations, iee,, Eq. (2) therein 28
215
216
217
reformulated as
v: (1V +)11)) 1/P
8(Φ) psign VV
218
where 1/p + 1/9 = and experimentally let = 2 as suggested by (28]. Then, we modify APART's first step by additionally perturbing the defensive parameters Φ + Φ + ((Φ) to enhance the
219
attacks with the second step unchanged. The additional perturbation )(Φ) just employs the gradient
221
V a R(x, y; Φ) previously computed by APART's first step, and normalizes them with ignorable extra computations. Therefore, APART-SAM is computation-friendly enhancement of APART.
222
Experiments
229
224
4.1
Experimental Setup
225
Datasets and Models. We evaluate APART on CIFAR-IO, CIFAR-100 24]. Tiny-ImageNet [25] and
226
ImageNet 266. On CIFAR datasets, we employ a WideRessNet-4-22 (55 (as implemented [56]),
227
Nestct-ResNet-18 18
557
(as implemented in (58). We use a Rre-ct-ResNet-188 on Tmageem
228
and R8
59 (as implemented in torchvision library (00 on ImageNet.
Implementation Details. On CIFAR-10 and CIFAR-100, we run all experiments by five different random seeds and report the mean and standard derivation of test accuracy. We employ SGD with initial learning rate 0.1, momentum 0.9 and weight decay 0.0005. We train models for 200 epochs and reduce the learning rate by 0.1 at the 100-th and 150-th epoch with batch size of 128. We use only the standard augmentations (i.e., random flipping and translation) in the basic experiments, and additionally leverage mixup (27] for further comparison. The hyperparameter a of mixup is set to 1 in the baseline as suggested by 277 and is properly chosen for APART. For comparison, we report the empirical results of SAM-trained 400 and PreAct- Restttt- under standard augmentation, where we set = 0.05 and p = 0.1 on CIFAR-I0 10 and CIFAR- 100 respectively, as suggested by (28]. On ImageNe,, we use batch size of 256 and set other hyperparameters in the same way of the CIFAR experiments; under mixup, we set a = 0.2 for both the standard method and APART. On ImageNet, We employ SGD with initial learning rate
230
231
232
233
234
237
238
239
240
241
0.1, momentum 0.9 and weight decay 0.0001. We train models with batch size of 256 for 105 epochs, where the learning rate is reduced by 0.1 at the 30-th, 60-th, 90-th and 100-th epoch. We randomly resize and crop images 224 x 224 resolution with random flipping to perform the

---

244
standard augmentation. For the hyperparameters of APART and APART-SAM, we evaluate a few combinations and show the best performance in the main results. More results of these combinations
245
246
are reported in the ablation studies and appendix A Considering the 2x training budget of APART, we also conduct the experiments of the standard training with 2x total and decay epochs
247
248
to show APART's non-trivial performance. Our implementations use Pytorch [6]], and all models
trained server with three NVIDIA RTX 3090 GPUs. Please appendix B and the code at http//tthuuuccccm
http://w...ccuuuuuooooo////aappa git for more details.
251
4.2
Main Results
Table 1: Results on CIFAR-10 and CIFAR-100.
Method (Augmentation)
Budget
CIFAR-10
CIFAR-100
Ree
Standard (Standard)
1x
9..6770.100+0.000
(+00000)
Standard (Standard)
2x
94.99+0..1
76.73 (+.00.3)) (+0.63)
SAM (Standard)
2x
(5.39+..u(+0.72))
77.47 (+1.37)
APART (Standard)
2x
95.69+0.x((11.02)
79.05 (+2.99)) (+2.95)
APART-SAM (Standard)
2x
95.81_0.27(+1.14)
79. 79.21=0.23
Standard (Mixup)
1x
15.433...1(00.700
(6.63=0..s(00..3)
Standard (Mixup)
2x
96.03 06.03_..11(+1..36
77.96=
APART (Mixup)
2x
05.8640.o6(+111111
79.22
APART-SAM (Mixup)
2x
95.78 (+..11
79.00=a.0d (+2.90)
Nre-et-ResNett118
Standard (Standard)
1x
94.60=0..1 (+0.000)
76.30 (+0.00)
Standard (Standard)
2x
94.76++0.12 +0.16)
75.34
SAM (Standard)
2x
78.57
APART (Standard)
2x
95.8440.00+11.24
19.48-...s(+3.188
APART-SAM (Standard)
2x
o..o
80.07
Standard (Mixup)
1x
95.7640.11 (+1.16)
77.30 s0 (++100)
Standard (Mixup)
2x
96.19+0.12 +1.59)
78.81 40 (+2.51)
APART (Mixup)
2x
96.28_o.ur (+1.68) (...6....u(+1.68)
80.07 a..77.77
APART-SAM (Mixup)
2x
80. 80.19 96.08
Evaluation on CIFAR-10 and CIFAR-100.
Table 2: Results on Imny-ImageNet and ImageNet.
253
As is shown in Table I APART helps mod- els significantly outperform their counter- parts trained by the standard method. Under standard augmentation, without considering the training budget, APART improves the accuracy by over 1.02% CIFAR-10 and 2.95% on CIFAR-100 for each model; con- sidering the training budget leads to the accu- racy gains of over 0.70% on CIFAR-10 10 and
Method (Augmentation)
Budget
Accuracy (%)
254
Tiny-ImageNet
255
Standard (Standard)
1x
63.52 (+0.00)
296
Standard (Mixup)
1x
64.34 (40.82)
257
Standard (Standard)
2x
63.94 (+0.42)
258
Standard (Mixup)
2x
64.54 (+1.02)
APART (Standard)
2x
67.00 (+3.48)
APART (Mixup)
2x
67.26 (+3.74)
APART-SAM (Standard)
2x
67.53 (+4.01)
261
APART-SAM (Mixup)
2x
68.66 (+5.14)
262
2.32% on CIFAR-100; enhanced by SAM,
ImageNet
263
APART-SAM further improves the accuracy of APART-trained models by over 0.12% on CIFAR-I0 and 0.16% on CIFAR-100. In addition, APART and APART-SAM out- perform SAM under this experimental set- ting. Under mixup 27] the improvements achieved by APART are generally consistent,
264
Standard (Standard)
1x
70.24 (+0.00)
Standard (Standard)
2x
71.25 (+1.01)
265
Standard (Standard)
4x
71.45 (+1.21)
APART (Standard)
2x
70,86 (+0.62)
257
APART (Standard)
4x
72.14 (+1.90)
288
APART-SAM (Standard)
2x
70.82 (+0.58)
269
270
though the APART-trained WideResNeet44-21 is somewhat inferior to the standard counterpart with
271
2x budget on CIFAR- 10; on the other hand, APART-SAM slightly degenerates due to the potential
272
conflicts between SAM and mixup on CIFAR datasets. Besides, mixup with sufficient training
budgets boosts the standard models more significantly, reducing the accuracy gap between them and the APART-trained counterparts.
7

---

275
Evaluation on Tiny-ImageNet and ImageNet. As is shown in Table APART and APART-SAM consistently improve the accuracy on ImageNet and its variant. On Tiny--IageeNe the accuracy gains are significant, e.g. the models trained by APART-SAM outperforms the standard counterparts by over 4% and 3.5% for x and 2x training budgets respectively under standard augmentation. Furthermore, APART-SAM enjoys the combination with mixup and improves the accuracy by over 5%. On ImageNet, APART with 2 budget outperforms the baseline with 1 budget, but is inferior to the standard training with 2x budget. However, scaling the training budgets leads to different result: APART with 4x budget outperforms the standard method with both 2x and 4x training budgets. It seems that APART employed on the large-scale dataset requires more steps to show 284 its promise. Besides, APART-SAM slightly degenerates due to the insufficient tuning of its more hyperparameters.
276
277
278
279
283
285
Table 3: Ablation studies of APART"s hyperparameters.
Budget
Accuracy (%)
4.3
Ablation Study
Standard Training
Table 3 shows the performance of the 288
1.00x
76. 24 0.00)
WideResNeet40-22 trained by APART with
1.20x
NA
NA
NA
36 0.14)
289
different hyperparameters in Algorithm [ on CIFAR-100, Overall, SPART-trainee models outperform all standard models de- spite training budgets and hyperparameters. For example, even the model trained by
2.00x
76.7340.27 -0.63)
290
APART
291
0.1
77.58+0.17 1.48)
282
1.19x
24
0.1
2
77.5040.17 17 1.40)
0.1
8
77.3540.30 1.25)
294
APART with 1.19x budget performs better than the standard model with x budget. On the other hand, APART's hyperparam- eters have impacts at different levels on its performance.
0.05
8
78.45 12
(2235)
295
0.1
8
78.8010.25 -2.70)
296
0.2
77.95
-1.85)
297
0.4
71.86+0.12
-1.24)
298
2.00x
128
0.1
78.36
-2266
0.1
78.54
-2.44)
Impact of N. The number of samples used in APART's second step has significant impact on its performance. Indeed, models with APART's adversarial BN statistics implicitly generate adversarial features within the models
0.1
16
79.05
-2.5
0.1
32
78.6940.181
2.59)
301
302
303
in the second pass. Therefore, more samples in this pass lead to more diversity required by models' robustness against the noisy BN statistics and improve the performance more significantly.
304
Impact of e. Large perturbation radii (e.g. 0.4) degenerate models' performance, since strong attacks caused by such radii force the models to sacrifice their generalization for more robustness. In contrast, smaller radii reduce both the robustness and accuracy, which illustrates the link between the generalization and robustness of APART-trained models.
308
307
308
Impact of The group number has relatively slight impact the accuracy, since it implicitly enhances the attack. A properly chosen can help APART achieve the best performance.
311
Evaluation on APART's Attacks
100
312
Experimental Setup. We evaluate APART's attacks to provide basic insight of its effectiveness. We use WideResNet- [55] pretrained on CIFAR-100. We perform APART's first step to adversarially shift its BN statistics without changing the other parameters. We use only batch
313
70
314
Accurscyr
40-2
317
40
Uniform
Bnary
318
Group
319
training samples for the attack, but eval-
APART 2 Groups
ARMII with Groups
320
uate the accuracy over the entire training dataset. For comparison, we provides the accuracy in the cases of random perturba-
10
Groups
ARART with Groups
0.00
0.65
0.10
0.0
0.35
0.30
Resturbation Badiua
tions, i.e. d 60 Uniform[-e,e
Figure 1: Evaluation on APART's Attacks.
8

---

randomly drawing 8μ 6g from {- formed by the binary values. Besides, we test different group numbers of APART to substantiate our insight of this trick.
324
325
326
Results. As shown in Figure the uniform random perturbations result almost no reduction in the accuracy despite the radii, while the binary random perturbations require sufficient large radii for the attack. In contrast, APART uses only a batch of samples generate the effective perturbations that reduce the accuracy even under a small radius. Additionally, the larger group numbers of APART
327
329
330
provide more significant accuracy reduction especially when the radii are more limited, demonstrating
331
our insight.
332
4.5
Robustness against Perturbed BN Statistics
333
Experimental Setup. We evaluate the robustness of the APART-trained models against perturbed BN statistics to provide the insight of APART's effectiveness. We employ the WideResNet-40-2 trained by the standard method with 1x and 2x training budgets and APART with different perturbation radii and group numbers on CIFAR-100 100. First, we randomly draw a direction v from {-1, 13 for each BN statistics with the same initial random seed shared across each experiment. Second, scale by different perturbation radii to perturb the estimated BN statistics, i.e., +- (1 cv) or (1 Ev Then, each model with the perturbed statisties is evaluated over the test samples.
334
335
336
337
340
Results. As is shown in Figure 2 mod- els' generalization is measured by the non- perturbed accuracy, and their robustness illustrated by the accuracy reduction sulting from the perturbations. APART- trained models generally outperform the standard models for both the generaliza- tion and robustness. Specifically, the stan- dard models (dashed lines) yield lower non- perturbed accuracy and suffers from more accuracy reduction as the perturbations in- crease. Meanwhile, more training epochs (dashed orange line) slightly improve the performance of the standard methods. On the other hand, APART performs better but requires a trade-off between the generaliza- tion and robustness. Increasing APART's radii improves both the robustness and generalization to some extent. However, large radius (e 0.4) results in the severe degeneration (solid pink line) in the generalization. Additionally, different group numbers of APART lead to improvement of the generalization and robustness to varying degrees but have no clear trend. In summary, APART consolidates models' robustness against noisy BN statistics to boost models' performance but requires a further generalization-rooustees. trade-off achieved by tuning the hyperparameters.
80-
341
342
343
30
345
346
40
Standlard with Ludket
bu.get
APURT with radius 0.05 and groups
347
APART with raduu 0.1 and grouss
348
radis 0.1
radius 0.1 and groups APAIII with radius 0.1 and 10 croups
349
350
10
APART radius 0.1 32
radus 0.2 and groups APART with radius 0.4 and groups
0.00
0.05
011
0.15
0.20
0.25
0.30
Perturbation Radius
353
Figure 2: Robustness of WideResNNet40-22 against per-
354
turbed BN statistics on CIFAR-100.
355
356
357
380
381
Conclusion and Discussion
362
363
In this paper, we identify the robustness against the noise in BN statisties bridge the generalization- robustness gap. Then, we proposed APART that implements new AT paradigm, termed model- based AT, to achieve such robustness. APART performs attacks and defense within models by two backward passes over each batch of benign samples, utilizing gradients efficiently. The empirical results demonstrate APART's effectiveness in improving the robustness, which further boosts model generalization on benign samples.
364
366
357
368
389
Limitations. Though APART improves models by solving BN-specific problem, and its variant suffer from the potential degeneration in case of the combination with other training methods implicitly involving BN, which results in more demand for fine-tuning the hyperparameters.

---

372 References
[1] Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In 2nd International Conference on Learning Representations, ICLR 2014, Banff. AB, Canada, April 14-16, 2014, Conference Track Proceedings, 2014.
375
376
377 [2] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and Harnessing Ad- versarial Examples. In 3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015.
378
379
380
[3]
Seyed-Mohsee Moosavi- -eaaa,,,e Alhussein Fawzi, and Pascal Frossard. DeepFool: Simple and Accurate Method to Fool Deep Neural Networks. In 2016 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, pages 2574-2582, 2016.
[4] Florian Tramèr, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On Adaptive Attacks to Adversarial Example Defenses. In Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NewrlPS
385
386
387
2020, December 6-12, 2020, Virtual., 2020.
388
[5] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards Deep Learning Models Resistant to Adversarial Attacks. In 6th International Confer- ence on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings, 2018.
389
390
382
[6] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically Principled Trade-off between Robustness and Accuracy. In Proceedings of the 36th International Conference on Machine Learning, pages 7472-7482, PMLR, May 2019.
394
385
[7] Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving Adversarial Robustness Requires Revisiting Misclassified Examples. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30,
398
397
398
2020, 2020.
399
[8] Dongxian Wu, Shu-Tao Xia, and Yisen Wang. Adversarial Weight Perturbation Helps Robust Generalization. In Advances in Neural Information Processing Systems, volume 33, pages 2958-2960 2969. Curran Associates, Inc., 2020.
400
401
402
[9] Dimitris Tsipras, Shibani Santurkar, Logan Engstrom, Alexander Turner, and Aleksander Madry. Robustness May Be at Odds with Accuracy. In 7th International Conference Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019, 2019.
405
[10] Aditi Raghunathan, Sang Michael Xie, Fanny Yang. John C. Duchi, and Percy Liang. Adversar- ial Training Can Hurt Generalization. arXiv:1906.06032, August 2019.
408
407
[11] Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L. Yuille, and Quoc V. Le. Adversarial Examples Improve Image Recognition. In 2020 JEEE/VE Conference on Computer Vision and Patern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020, pages 816-
408
409
410
825, 2020.
411
[12] Sergey loffe and Christian Szegedy. Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift. In Proceedings of the 32nd International Conference on Machine Learning, ICML 2015, Lille, France, 6-11 July 2015, pages 448 456, 2015.
412
[13] Jieru Mei, Yucheng Han, Yutong Bai, Yixiao Zhang, Yingwei Li. Xianhang Li, Alan Yuille, and Cihang Xie. Fast AdvProp. In International Conference Learning Representations, 2021.
10

---

418
[14] Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020, 2020.
417
418
419
[15] Manli Shu, Zuxuan Wu, Micah Goldblum, and Tom Goldstein. Encoding robustness to image style via adversarial feature perturbations. In Advances in Neural Information Processing Systems, volume 34, 2021.
420
421
[16] Haotao Wang, Chaowei Xiao, Jean Kossaifi, Zhiding Yu, Anima Anandkumar, and Zhangyang Wang. Augmax: Adversarial composition of random augmentations for robust training. In Advances in Neural Information Processing Systems, volume 34, 2021.
425
[17] Tejas Gokhale, Rushil Anirudh, Bhavya Kailkhura, Jayaraman J. Thiagarajan, Chitta Baral, and Yezhou Yang. Attribute-Guided Adversarial Training for Robustness to Natural Perturbations. In Thirty-Fifth AAAI Conference on Artificial Intelligence, AAAI 2021, Thirty-Thibe Conference on Innovative Applications of Artificial Intelligence, IAAI 2021, The Eleventh Symposium on Educational Advances in Artificial Intelligence, EAAI 2021, Virtual Event, February 2-9, 2021, pages 7574-7582, 2021.
426
427
428
429
430
[18] Jimmy Lei Ba, Jamie Ryan Kiros, and Geoffrey E Hinton. Layer normalization. arXiv preprint arXiv: 1607.06450 2016.
433
[19] Dmitry Ulyanov, Andrea Vedaldi, and Victor Lempitsky. Instance normalization: The missing ingredient for fast stylization. arXiv preprint arXiv:1607.0000 2016
434
435
[20] Yuxin Wu and Kaiming He. Group Normalization. In Computer Vision ECCV 2018 - 15th
436
European Conference, Munich, Germany, September 8-14, 2018, Proceedings, Part XIII, pages 3- 2018
437
438
[21] Ping Luo, Jiamin Ren, Zhanglin Peng, Ruimao Zhang, and Jingyu Li. Differentiable Learning- to-Normalize via Switchable Normalization. In 7th International Conference on Learning Representations, ICLR 2019, New Orleans, LA, USA, May 6-9, 2019, 2019.
439
[22] Saurabh Singh and Abhinav Shrivastava. EvalNorm: Estimating Batch Normalization Statistics for Evaluation. In 2019 IEEE/CVF International Conference on Computer Vision, ICCV 2019, Seoul, Korea (South), October 27 November 2, 2019, pages 3632-3640, 2019.
443
444
(23] Guangrun Wang, Jiefeng Peng, Ping Luo, Xinjiang Wang, and Liang Lin. Kalman Normaliza- tion: Normalizing Internal Representations Across Network Layers. In Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurlPS 2018, December 3-8, 2018, Montréal, Canada., pages 21-31, 2018
445
446
447
448
[24] Krizhevsky. Learning multiple layers of features from tiny images. Master's thesis, University of Tront, 2009.
[25]
Patryk Chrabaszez, Ilya Loshchilov, and Frank Hutter. A Downsampled Variant of ImageNet as an Alternative to the CIFAR datasets. arXiv: 1707.0890,,,, August 2017.
452
[26]
Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, Alexander C. Berg, and Li Fei-Fei. ImageNet Large Scale Visual Recognition Challenge. International Journal of Computer Vision, December 2015.
453
454
455
115(3):211-255
456
[27] Hongyi Zhang, Moustapha Cissé, Yann N. Dauphin, and David Lopez-Paz. Mixup: Beyond Empirical Risk Minimization. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3. 2018, Conference Track Proceedings. 2018.
457
11

---

480
[28]
Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness- mini- mization for efficiently improving generalization. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021.
461
462
463
[29]
Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent Advances in Adversarial Training for Adversarial Robustness. In Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence. IJCAI 2021, Virtual Event Montreal, Canada, 19-27 August 2021., pages 4312-4321, 2021.
464
487
[30]
Kevin Roth, Yannic Kilcher, and Thomas Hofmann. The Odds are Odd: A Statistical Test for Detecting Adversarial Examples. In Proceedings of the 36th International Conference on Machine Learning, ICML 2019, 9-15 June 2019, Long Beach, California, USA, pages 1198-5507, 2019.
488
469
470
[31] Yingzhen Li, John Bradshaw, and Yash Sharma. Are Generative Classifiers More Robust to Adversarial Attacks? In Proceedings of the 36th International Conference on Machine Learning, ICMI. 2019, 9-15 June 2019, Long Beach, California, USA, pages 3804-3814 381,, 2019.
473
474
[32] Tianyu Pang, Kun Xu, and Jun Zhu. Mixup Inference: Better Exploiting Mixup to Defend Adversarial Attacks. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020, 2020.
475
476
[33] Yuzhe Yang, Guo Zhang, Zhi Xu, and Dina Katabi. ME-Net: Towards Effective Adversarial Robustness with Matrix Estimation. In Proceedings of the 36th International Conference on Machine Learning, ICML 2019, 9-15 June 2019, Long Beach, California, USA, pages 7024-7034, 2019.
479
480
481
[34]
Runtian Zhai, Tianle Cai, Di He, Chen Dan, Kun He, John Hopcroft, and Liwei Wang. Adversar- ially robust generalization just requires more unlabeled data, arXiv preprint arXiv: 00011100005555 2019.
482
483
[35]
Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially Robust Generalization Requires More Data. In Advances in Neural Information Processing Systems 31: Anmual Conference on Neural Information Processing Systems 2018, NeurlPS 2018, December 3-8, 2018, Montréal, Canada., pages 5019-5031, 2018.
486
487
488
[36]
Yifei Min, Lin Chen, and Amin Karbasi. The curious case of adversarially robust models: More data can help, double descend, or hurt generalization. In Proceedings of the Thirty-Seventh Conference on Uncertainty in Artificial Intelligence, UAI 2021, Virtual Event, 27-30 July 2021, pages 129 139, 2021.
489
490
[37] Jean- -aptisst Alayrac Jonathan Uesato, Po-Sen Huang, Alhussein Fawzi, Robert Stanforth, 482
483
and Pushmeet Kohli. Are Labels Required for Improving Adversarial Robustness? In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada., pages 2212-11202.. 2019.
494
495
496
487
(38]
Ali Shafahi, Mahyar Najibi, Amin Ghiasi, Zheng Xu, John P. Dickerson, Christoph Studer, Larry S. Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! In Advances in Neural Information Processing Systems 32: Annual Conference on Neural Information Processing Systems 2019, NeurIPS 2019, December 8-14, 2019, Vancouver, BC, Canada., pages 3353-3364 2019.
499
500
501
502
[39] Maksym Andriushchenko and Nicolas Flammarion. Understanding and Improving Fast Adver- sarial Training. In Advances Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NewrIPS 2020, December 6- 2020, Virtual.,
503
2020.
12

---

506
[40] Hoki Kim, Woojin Lee, and Jaewook Lee. Understanding Catastrophic Overfitting in Single-step Adversarial Training. In Thirty-Fifth AAAI Conference on Artificial Intelligence, AAAI 202 I, Thirty-Third Conference on Innovative Applications of Artificial Intelligence, IAAI 2021, The Eleventh Symposium on Educational Advances in Artificial Intelligence, EAAI 2021, Virtual Event, February 2-9, 2021, pages 8119-8127, 2021.
507
508
509
510
511
[41] B. S. Vivek and R. Venkatesh Babu. Single-Step Adversarial Training With Dropout Scheduling. In 2020 IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), pages 947-956, June 2020.
512
513
514
[42] BS Vivek and R Venkatesh Babu. Regularizers for single-step adversarial training. In arXiv Preprint arXiv:2002.0063 2020.
515
516
[43] Jungmin Kwon, Jeongseop Kim, Hyunseo Park, and In Kwon Choi. ASAM: Adaptive Sharpness- Aware Minimization for Scale-Invariant Learning of Deep Neural Networks. In Proceedings of the 38th International Conference on Machine Learning, ICML 2021, 18-24 July 2021, Virtual Event., pages 5905-5914, 2021.
517
518
519
520
[44] Juntang Zhuang, Boqing Gong, Liangzhe Yuan, Yin Cui, Hartwig Adam, Nicha C Dvornek, James Duncan, Ting Liu, et al. Surrogate gap minimization improves sharpness-aware training. In International Conference on Learning Representations, 2021.
521
523
[55] Xu Sun, Zhiyuan Zhang, Xuancheng Ren, Ruixuan Luo, and Liangyou Li. Exploring the Vulnerability of Deep Neural Networks: A Study of Parameter Corruption. In Thirty-Fifth AAAI Conference on Artificial Intelligence, AAAI 2021, Shiirty-Thire Conference Innovative Applications of Artificial Intelligence, IAAI 2021, The Eleventh Symposium on Educational Advances in Artificial Intelligence, EAAI 2021, Virtual Event, February 2-9, 2021, pages
524
526
527
528
1648--1656, 2021.
529
[46] Tianlong Chen, Yu Cheng, Zhe Gan, Jianfeng Wang, Lijuan Wang. Zhangyang Wang, and Jingjing Liu. Adversarial feature augmentation and normalization for visual recognition. arXiv preprint arXiv:2 /2171, 2021.
530
531
532
[47] Amil Merchant, Barret Zoph, and Ekin Dogus Cubuk. Does data augmentation benefit from split batchnorms. arXiv preprint arXiv:2010.07810, 2020.
533
[48] Charles Herrmann, Kyle Sargent, Lu Jiang, Ramin Zabih, Huiwen Chang, Ce Liu, Dilip Krishman, and Deqing Sun. Pyramid Adversarial Training Improves ViT Performance. arXiv:2111.15121 [cs], November 2021.
535
536
537
[49] Xinyu Gong, Wuyang Chen, Tianlong Chen, and Zhangyang Wang. Sandwich Batch Normal- ization: A Drop-In Replacement for Feature Distribution Heterogeneity. In 2022 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 2957-2967, Waikoloa, HI, USA, Jamuary 2022. IEEE
538
539
540
541
[50]
You Huang and Yuanlong Yu. An Internal Covariate Shift Bounding Algorithm for Deep Neural Networks by Unitizing Layers' Outputs. In 2020 IEEF/CVF Conference on Computer Vision and Pattern Recognition, CVPR 2020, Seattle, WA, USA, June 13-19, 2020, pages 8462-8470, 2020.
542
543
544
545
[51] Wenqi Shao, Tianjian Meng, Jingyu Li, Ruimao Zhang, Yudian Li, Xiaogang Wang, and Ping Luo. SSN: Learning Sparse Switchable Normalization via SparsestMax. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2019, Long Beach, CA, USA, June 16-20.
546
547
2019, pages 443 451, 2019.
549
[52] Xingang Pan, Ping Luo, Jianping Shi, and Xiaoou Tang. Two at Once: Enhancing Learning and Generalization Capacities via IBN-Net. In Computer Vision ECCV 2018 15th European Conference, Munich, Germany, September 8-14, 2018, Proceedings, Part IV, pages 484-500, 2018.
550
13

---

553
[53] Tianyu Pang, Xiao Yang, Yinpeng Dong, Hang Su, and Jun Zhu. Bag of tricks for adversarial training. arXiv preprint arXiv:2010.00467, 2020.
554
555
[54] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. Advances in neural information processing systems, 27, 2014.
556
558
[55] Sergey Zagoruyko and Nikos Komodakis. Wide Residual Networks, In British Machine Vision Conference 2016, York, France, 2016. British Machine Vision Association.
559
580
[56] Jason Kuen. URL http:://ssshaucoooommmm////////s
[57] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity Mappings in Deep Residual Networks. In Computer Vision ECCV 2016 14th European Conference, Amsterdam, The Netherlands, October 11 11-14, 2016, Proceedings. Part IV, pages 630-645, 2016.
562
589
564
[58] Kuang Liu. URL https///ttttt..coommuuaaai////ot
[59] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep Residual Learning for Image Recognition. In 2016 IEEE Conference Computer Vision and Pattern Recognition, CVPR 2016, Las Vegas, NV, USA, June 27-30, 2016, pages 770-778, 2016.
587
568
[60] Sébastien Marcel and Yann Rodriguez. Torchvision the machine- package of torch. In Proceedings of the 18th ACM International Conference on Multimedia, pages 1485-1488, 2010.
569
[61]
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. Py Torch:: An imperative style, high- performance deep learning library. H. Wallach, H. Larochelle, A. Beygelzimer, F. dAlché-Buu Buc, F. Fox, and Garnett, editors, Advances in Neural Information Processing Systems 32, pages 8024-8035. Curran Associates, Inc., 2019.
572
573
574
575
578
Checklist
1. For all authors...
579
(a) Do the main claims made in the abstract and introduction accurately reflect the paper's
580
contributions and scope? [Yes]
581
(b) Did you describe the limitations of your work? [Yes]
582
(c) Did you discuss any potential negative societal impacts of your work? [No]
583
(d) Have you read the ethics review guidelines and ensured that your paper conforms to them? [Yes]
584
2. If you are including theoretical results...
586
(a) Did you state the full set of assumptions of all theoretical results? [N/A]
587
(b) Did you include complete proofs of all theoretical results? [N/A]
3. If you experiments...
589
(a) Did you include the code, data, and instructions needed reproduce the main ex- perimental results (either in the supplemental material as a URL)? [Yes] See the supplemental materials
580
592
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)? [Yes] See the experimental setup
593
(c) Did you report error bars (e.g., with respect the random seed after running experi- ments multiple times)? [Yes]
14

---

596
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)? [Yes]
587
598
4. If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators? [Yes]
600
(b) Did you mention the license of the assets? [N/A]
(c) Did you include any new assets either in the supplemental material or URL? [No]
Only existing datasets are used.
603
(d) Did you discuss whether and how consent was obtained from people whose data you rr using/curating? [N/A]
604
605
(e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content? [N/A]
606
807
5. If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if applicable? [N/A]
609
610
(b) Did you describe any potential participant risks, with links Institutional Review Board (IRB) approvals, if applicable? [N/A]
612
(c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A]
613
15


Reviews:
[{"review_id": "cQ48IUAjIlj", "reviewer": "Reviewer_STBH", "summary": "This paper proposes to add adversarial noise on the BN statistics to improve classification accuracy on in-distribution images. ", "questions": "Please see above", "limitations": "Please see above", "rating": 3, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength:\n1. The paper is well-written and easy to follow. The related works are thoroughly discussed. \n\nWeakness:\n1. The novelty is limited. The proposed method is almost identical with AdvBN [15] (NeurIPS'21). Although the authors mentioned three differences in related work section, I still think they are all minor differences. \n2. In experiments, no results on [11] or [15] are reported. This makes it hard to evaluate whether the proposed method can outperform previous works. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "GQufvbUajNF", "reviewer": "Reviewer_sCRg", "summary": "The paper proposes a method to improve the generalization of neural networks by training them to be robust to adversarial perturbations in the statistics of the batch normalization (BN) layers. The approach combines gradients computed on unperturbed BN statistics with gradients computed on perturbed statistics. Perturbations or noise in the BN statistics are obtained through 1) signed gradients from the first update and 2) reductions in the batch size for the second update.\nExperiments demonstrate improvements over standard training, especially in the case of smaller-scale datasets, i.e., CIFAR and Time-ImageNet. The method can also be combined with other techniques, such as Mixup and SAM optimization, typically leading to further improvements.   ", "questions": "I would appreciate it if the authors could address the weakness listed above, especially the first three points, i.e., \n- How is the robustness to other typical adversarial attacks?\n- How is the introduced AT paradigm different from what prior works proposed, or what novel insights are provided?\n- What are the issues with large-scale training?", "limitations": "As mentioned above, it might be good to further address the performance on larger scale datasets if this turns out to be a limitation. Also, depending on how robust the method is to other adversarial perturbations, this could also be mentioned in the limitations.", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n- The method benefits the generalization of neural networks trained on smaller datasets considerably\n- The technical presentation of the method in Section 3.2 is detailed and sufficiently clear\n- The method can be combined with other training methods, such as SAM. \n\n\nWeaknesses:\n- The paper claims to bridge the gap between robustness and generalization. Experiments are focused mainly on the generalization ability of the learned networks, and robustness experiments are restricted to perturbations of the BN statistics. This is quite limited, and it is unclear if the learned networks are robust to various other adversarial attacks. Indeed, it is unclear what the relevance of Sections 4.4 and 4.5 are regarding the robustness of the networks in practice. \n- Another contribution of the paper is \"a new AT paradigm, termed model-based AT.\" It appears that the main idea of perturbing model parameters has been explored in various prior works (e.g., [8, 28]). It is not clear what the generic formulation in Eq 2 contributes or what novel insights are provided. \n- The benefits of the method seem to disappear during large-scale experiments on ImageNet. This is somewhat concerning, and it might be good to investigate this issue further. \n- Section 3.3 is somewhat confusing: L206 claims \\mathcal{R}=0, but then \\mathcal{R} appears in the perturbation computation of (7). It is also unclear if a term similar to g_\\phi exists in this case. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "FsXHRovW6BS", "reviewer": "Reviewer_3xFg", "summary": "This paper introduces an ‘Adversarially Perturbed Batch Normalization’ to improve the model’s generalization and robustness. Experiments on CIFAR, Tiny-ImageNet, and ImageNet show that the proposed methods can improve the models’ performance, compared with the baseline model. ", "questions": "I would like to see the experimental results on the robustness benchmarks (e.g., ImageNet-C). As the main contribution lies in the model's generalization and robustness, the robustness result is must-needed, in my opinion.", "limitations": "For me, the current experiments are not sufficient. The authors are suggested to add more experiments to show the advantages of their paper.", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "\nStrengths:\nCompared with the previous AdvBN [15], the proposed APART is more appliable and easy-training. \nThe paper is well-written, and the theoretical analysis is clear.\n\n\nWeaknesses:\nExperiments\nFrom the reviewer’s view, the experiments in this paper are not sufficient.\n(1)\tAs mentioned in Lines 62-63, the author mentioned that they want to bridge the gap between the model’s generalization and robustness. The reviewer thinks experiments on ImageNet-C or Stylized ImageNet are needed to show the advantages of robustness. \n(2)\tThe comparison with other methods is missing. The reviewer thinks a comparison with normalization methods [18-20] and adversarial methods [11, 15] is needed.\n(3)\t‘Mix-Up’ experiments on ImageNet are missing.\n(4)\tSimilar to the experiments on CIFAR-10 and CIFRA-100, the authors are suggested to conduct the experiments on one more backbone on Tiny-ImageNet and ImageNet.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "BLP-ko1mdm3", "reviewer": "Reviewer_fuBX", "summary": "While Adversarial Training is one of the most successful methods to increase robustness, it usually degrades performance of the models on clean images. The authors attribute this to distributional discrepancy in Batch Norm statistics. They propose Adversarially Perturbed bAtch noRmalizaTion (APART) to achieve robustness against BN statistics noise, and to bridge the gap between models’ generalization and robustness. They perform backward passes twice over each batch of clean samples. The first backward pass produces two gradient computations: a normal gradient that helps update parameters of model, and a statistics gradient that is used to perturb the statistics parameters in BN. The second pass is performed to generate the defensive gradient that helps the model resist the adversarial statistics perturbation. The normal and defensive gradients are combined to improve both generalization and robustness of the model. Experiments are performed on CIFAR, Tiny-ImageNet and ImageNet, and show improved clean accuracy over standard training and SAM [28].  \n\n\n", "questions": "See the Clarity section above. ", "limitations": "- The authors have addressed limitation of the work in terms of suffering from potential degeneration in case of the combination with other training methods implicitly involving BN. \n- The authors can address potential limitation of their work on large-scale datasets and models. \n- There are no potential negative societal impact that need to be specifically addressed. ", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**Originality and Significance**:\n- The paper presents a new way of bridging the gap between models’ generalization and robustness. It is known in the literature that there is discrepancy between Batch Norm statistics of clean and adversarial examples [13] (as well as the statistics from different batches). AdvProp proposes using two batch norm statistics, one for clean images and one auxiliary for adversarial examples [13]. Rather than creating a separate layer to deal with this discrepancy, the paper attempts to make the models robust to the BN statistics noise. This approach is interesting and novel to the best of my knowledge.   \n- The method can be combined with other augmentations to further boost performance. The proposed combination with SAM (as one of the state-of-the-art methods) is particularly promising. \n\n**Quality**:\n- Overall the paper is well-structured and well-written.\n- The proposed approach is sound, and is described clearly. \n- Experiments are performed on various datasets including CIFAR-10, CIFAR-100, Tiny-ImageNet and ImageNet. Overall, experimental results are convincing. They demonstrate improvements on clean accuracy over the baselines as well as robustness against perturbed BN statistics. Comparing with baselines using the same budget is important given the additional cost of the proposed approach.   \n- The authors report detailed experimental results in the supplementary material, and show that ARAPT is relatively insensitive to hyper-parameters. \n\n**Clarity**:\n- Scalability of ARAPT to large datasets and models is not clearly supported in the experiments. The authors use the relatively small ResNet-18 model on ImageNet-1K. ARAPT underperforms standard training on ImageNet at 2x budget and outperforms it at 4x budget (Table 2). The authors note that \"APART employed on the large-scale dataset requires more steps to show its promise\", but do not provide further explanation or experiments on this. \n- All experiments are performed on the ResNet family. On ImageNet the achieved accuracy of 72.14% (Table 2) is far from the state-of-the-art. It'd be good to include experiments on other architectures (e.g. EfficientNet), and see if the gains are significant. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}]

Author rebuttal:

Decision: Reject