Batch Normalization (BatchNorm) has shown to be effective for improving and accelerating the training of deep neural networks. However, recently it has been shown that it is also vulnerable to adversarial perturbations. In this work, we aim to investigate the cause of adversarial vulnerability of the BatchNorm. We hypothesize that the use of different normalization statistics during training and inference (mini-batch statistics for training and moving average of these values at inference) is the main cause of this adversarial vulnerability in the BatchNorm layer. We empirically proved this by experiments on various neural network architectures and datasets. Furthermore, we introduce Robust Normalization (RobustNorm) and experimentally show that it is not only resilient to adversarial perturbation but also inherit the benefits of BatchNorm.
This paper addresses a limitation of BatchNorm: vulnerability to adversarial perturbations. The authors propose a possible explanation of this issue and correspondingly an alternative called RobustNorm to tackle this problem. Specifically, the authors observe that the statistics of BatchNorm for training and inference are different, resulting in different data distributions for training and inference. To solve this problem, the authors propose to use min-max rescaling instead of normalization. In addition, the running average is calculated with mean and the running mean of the denominator during inference. Experimental results show significant improvement of robustness and also comparable accuracy for clean data.
The paper is well-written and the contributions are stated clearly. The explanation of vulnerability is reasonable. The proposed solution is simple but effective.
However, I have several concerns:
*The authors verify that the running average is the main culprit of vulnerability to adversarial attack, but provide no further investigation of why this happens. A possible solution is the drift in input distributions, but the manuscript does not state clearly how is the distribution changed. Further experiments would have made this claim more convincing.
*The proposed method involves a hyper-parameter \rho, but it may result in problematic issues. The variance of input is of the same order of magnitude as (max(x)-min(x))^2. If \rho is set to other value, the magnitude of gradient will change drastically during back-propagation. Although \rho can be set to 0.2, it still seems ad-hoc. Experiments on more datasets and the sensitivity of the proposed method to \rho would have validated the claims of the authors.