Achieving Both Model Accuracy and Robustness by Adversarial Training with Batch Norm Shaping

Adversarial training is an important approach to improving Deep Learning model robustness. It uses attack methods to generate adversarial samples that can maximize the chance of misclassification and updates model weight values accordingly to ensure these samples are not misclassified. It is difficult to retain model accuracy while improving robustness using adversarial training. In this paper, we study one of the important factors causing this undesirable effect - batch normalization. We find that batch normalization has three confoundings in adversarial training, which may cause model accuracy degradation and/or sub-optimal robustness improvement. We propose a novel adversarial training method called norm shaping, in which a model always uses batch norms, in both adversarial training and inference. It enforces that a batch (in both training and inference) should always have at least a dominating portion of clean samples such that the batch norms follow a distribution similar to that of clean sample batches. Our results show that it can substantially improve existing adversarial training methods (for models with batch normalization layers), such as PGD and TRADES. On CIFAR-10, it can achieve much better model accuracy and robustness on a list of existing attacks. For example, it can achieve 0.94 model accuracy and 0.81 robustness against PGD attack while TRADES and PGD adversarial trainings can achieve around 0.88 accuracy and 0.47 robustness. Our method also has 0.51 robustness against the strongest adaptive attack.

I. Introduction

Robustness in Deep Learning dictates that model classification results should be robust in the presence of bounded input perturbation. It is an important property because in real world applications, model inputs have all kinds of noise due to environmental condition variations. Model misbehaviors such as misclassification may be induced if an unrobust model is used. Many may have catastrophic consequences. For example, perception model misclassification (e.g., object detection model or depth estimation model) in autonomous driving vehicles may endanger human lives. There are many methods to improve model robustness and trustability of classification results even when the model is unrobust, such as adversarial input detection [6], [10], [21], [24], [36], model certification [16], model symbolic analysis [3], [9], [12], [19], [33], [37], and adversarial training [13], [18], [23], [26], [29], [30], [32], [38]. T Among them, adversarial training is one of the most popular methods. It leverages adversarial attack to generate input perturbations for given clean inputs. The perturbed inputs are called adversarial samples, which are used to train the model such that misclassifications can be prevented.