Batch Normalization is a Cause of Adversarial Vulnerability

By Angus Galloway, Anna Golubeva, Thomas Tanay, Medhat A. Moussa, Graham W. Taylor. 2019

85 citations recorded by the source corpus.

Batch normalization (batch norm) is often used in an attempt to stabilize and accelerate training in deep neural networks. In many cases it indeed decreases the number of parameter updates required to achieve low training error. However, it also reduces robustness to small adversarial input perturbations and noise by double-digit percentages, as we show on five standard datasets. Furthermore, substituting weight decay for batch norm is sufficient to nullify the relationship between adversarial vulnerability and the input dimension. Our work is consistent with a mean-field analysis that found that batch norm causes exploding gradients.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Eric P. Xing
2. Ling Shao
3. Haohan Wang
4. Fan Zhu
5. Li Liu
6. Jie Qin
7. Yi Zhou
8. Pengcheng Yin

In Electrical and Electronic Engineering

1. Eric P. Xing
2. Ling Shao
3. Graham W. Taylor
4. Li Liu

Citations in the corpus

• Normalization Techniques in Training DNNs: Methodology, Analysis and Application (2020, background): “…representation learning [219], [220], permutation-equivariant networks [221], [222], graph neural networks [223], ordinary differential equation (ODE) based networks [224], symmetric positive definite (SPD) neural networks [225], and guarding against adversarial attacks [226], [227], [228].”
• High-Frequency Component Helps Explain the Generalization of Convolutional Neural Networks (2019, background): “This BatchNorm’s tendency in capturing HFC is also re-lated to observations that BatchNorm encourages adversarial vulnerability [18].”
• Improving robustness against common corruptions by covariate shift adaptation (2020, unknown): “[38].”
• Parameter Prediction for Unseen Deep Architectures (2021, background): “Next, we define the BN-FREE set that is of interest due to BN’s potential negative side-effects [52, 53] and the difficulty or unnecessity of using it in some cases [54–56, 36, 37].”