Prepare for the Worst: Generalizing across Domain Shifts with Adversarial Batch Normalization
Authors: Manli Shu, Zuxuan Wu, Micah Goldblum, Tom Goldstein
Keywords: adversarial training, distributional shifts
Abstract: Adversarial training is the industry standard for producing models that are robust to small adversarial perturbations.  However, machine learning practitioners need models that are robust to other kinds of changes that occur naturally, such as changes in the style or illumination of input images. Such changes in input distribution have been effectively modeled as shifts in the mean and variance of deep image features.   We adapt adversarial training by adversarially perturbing these feature statistics, rather than image pixels, to produce models that are robust to distributional shifts. We also visualize images from adversarially crafted distributions. Our method, Adversarial Batch Normalization (AdvBN), significantly improves the performance of ResNet-50 on ImageNet-C (+8.1%), Stylized-ImageNet (+6.7%), and ImageNet-Instagram (+3.9%) over standard training practices.  In addition, we demonstrate that AdvBN can also improve generalization on semantic segmentation.