Batch Normalization Increases Adversarial Vulnerability and Decreases Adversarial Transferability: A Non-Robust Feature Perspective

Benz, Philipp; Zhang, Chaoning; Kweon, In So

doi:10.1109/iccv48922.2021.00772

Cited by 13 publications

(16 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recent works have explored the effect of BatchNorm and estimated statistics on the adversarial vulnerability of deep models. To start with, Benz et al [5] investigated the contribution of Non-Robust Features (NRFs) in increasing the performance of models. They show that BatchNorm's use of NRFs is the predominant reason for the improvement in the performance of deep models.…”

Section: Related Workmentioning

confidence: 99%

Adversarial Attacks and Batch Normalization: A Batch Statistics Perspective

2023

View full text Add to dashboard Cite

Batch Normalization (BatchNorm) is an effective architectural component in deep learning models that helps to improve model performance and speed up training. However, it has also been found to increase the vulnerability of models to adversarial attacks. In this study, we investigate the mechanism behind this vulnerability and took first steps towards a solution called RobustNorm. We observed that adversarial inputs tend to shift the distributions of the output of the BatchNorm layer, leading to inaccurate train-time statistics and increased vulnerability. Through a series of experiments on various architectures and datasets, we confirm our hypothesis. We also demonstrate the effectiveness of RobustNorm in improving the robustness of models under adversarial perturbation while maintaining the benefits of BatchNorm.INDEX TERMS Batch normalization, adversarial robustness, transfer learning.

show abstract

Section: Related Workmentioning

confidence: 99%

Adversarial Attacks and Batch Normalization: A Batch Statistics Perspective

2023

View full text Add to dashboard Cite

show abstract

“…The proposed method is rooted in the one-stage detector SSD [19] with VGG16 as the backbone. Considering that Batch Normalization would increase the adversarial vulnerability [1], we make a modification on VGG16 without batch normalization layers [19]. In experiments, we use the model pre-trained on clean images for adversarial training and employ Stochastic Gradient Descent (SGD) with a learning rate of 10 −3 , momentum 0.9, weight decay 0.0005 and batch size 32 with the multi-box loss.…”

Section: Implementation Detailsmentioning

confidence: 99%

Adversarially-Aware Robust Object Detector

Dong¹,

Wei²,

Li³

2022

Preprint

View full text Add to dashboard Cite

Object detection, as a fundamental computer vision task, has achieved a remarkable progress with the emergence of deep neural networks. Nevertheless, few works explore the adversarial robustness of object detectors to resist adversarial attacks for practical applications in various real-world scenarios. Detectors have been greatly challenged by unnoticeable perturbation, with sharp performance drop on clean images and extremely poor performance on adversarial images. In this work, we empirically explore the model training for adversarial robustness in object detection, which greatly attributes to the conflict between learning clean images and adversarial images. To mitigate this issue, we propose a Robust Detector (RobustDet) based on adversarially-aware convolution to disentangle gradients for model learning on clean and adversarial images. RobustDet also employs the Adversarial Image Discriminator (AID) and Consistent Features with Reconstruction (CFR) to ensure a reliable robustness. Extensive experiments on PASCAL VOC and MS-COCO demonstrate that our model effectively disentangles gradients and significantly enhances the detection robustness with maintaining the detection ability on clean images. Our source code and trained models are publicly available at: https://github.com/7eu7d7/RobustDet

show abstract

“…Understanding transferability from the perspective of pixel interaction [40] has also been investigated. Through the lens of non-robust feature [19], a recent work [3] has shown that adversarial tranferability can be improved by removing BN from the surrogate model. Even though the rationality behind transferability is still not fully understood, this intriguing property has been widely exploited for black-box attacks.…”

Section: Related Workmentioning

confidence: 99%

Investigating Top-$k$ White-Box and Transferable Black-box Attack

Zhang¹,

Benz²,

Karjauv³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Existing works have identified the limitation of top-1 attack success rate (ASR) as a metric to evaluate the attack strength but exclusively investigated it in the white-box setting, while our work extends it to a more practical blackbox setting: transferable attack. It is widely reported that stronger I-FGSM transfers worse than simple FGSM, leading to a popular belief that transferability is at odds with the white-box attack strength. Our work challenges this belief with empirical finding that stronger attack actually transfers better for the general top-k ASR indicated by the interest class rank (ICR) after attack. For increasing the attack strength, with an intuitive interpretation of the logit gradient from the geometric perspective, we identify that the weakness of the commonly used losses lie in prioritizing the speed to fool the network instead of maximizing its strength. To this end, we propose a new normalized CE loss that guides the logit to be updated in the direction of implicitly maximizing its rank distance from the ground-truth class. Extensive results in various settings have verified that our proposed new loss is simple yet effective for top-k attack.

show abstract

Batch Normalization Increases Adversarial Vulnerability and Decreases Adversarial Transferability: A Non-Robust Feature Perspective

Cited by 13 publications

References 12 publications

Adversarial Attacks and Batch Normalization: A Batch Statistics Perspective

Adversarial Attacks and Batch Normalization: A Batch Statistics Perspective

Adversarially-Aware Robust Object Detector

Investigating Top-$k$ White-Box and Transferable Black-box Attack

Contact Info

Product

Resources

About