Artificial Intelligence, Machine Learning, Data Science, Data, NLP.
layers can result in non-trivial adversarial robustness. Adversarially training only the BN layers from scratch, in contrast, is not able to convey meaningful adversarial ro- bustness. Our results indicate that fragile features can be used to learn models with moderate adversarial robustness, while