论文标题
在脆弱的特征和对抗训练中的批处理
On Fragile Features and Batch Normalization in Adversarial Training
论文作者
论文摘要
现代深度学习体系结构利用批处理（BN）来稳定训练并提高准确性。已经表明，单独的BN层具有令人惊讶的表现力。然而，在反对对抗性例子的鲁棒性的背景下，BN被认为增加了脆弱性。也就是说，国阵有助于学习脆弱的特征。尽管如此，国阵仍在对抗训练中，这是学习强大功能的事实上的标准。为了阐明BN在对抗训练中的作用，我们研究了与随机特征相比，BN在多大程度上可以使用脆弱的特征。在CIFAR10上，我们发现仅在BN层上进行对抗进行微调会导致非平凡的对抗性鲁棒性。相比之下，只有从头开始训练BN层的对手训练无法传达有意义的对抗性鲁棒性。我们的结果表明，脆弱的功能可用于学习具有适度对抗性鲁棒性的模型，而随机功能不能
Modern deep learning architecture utilize batch normalization (BN) to stabilize training and improve accuracy. It has been shown that the BN layers alone are surprisingly expressive. In the context of robustness against adversarial examples, however, BN is argued to increase vulnerability. That is, BN helps to learn fragile features. Nevertheless, BN is still used in adversarial training, which is the de-facto standard to learn robust features. In order to shed light on the role of BN in adversarial training, we investigate to what extent the expressiveness of BN can be used to robustify fragile features in comparison to random features. On CIFAR10, we find that adversarially fine-tuning just the BN layers can result in non-trivial adversarial robustness. Adversarially training only the BN layers from scratch, in contrast, is not able to convey meaningful adversarial robustness. Our results indicate that fragile features can be used to learn models with moderate adversarial robustness, while random features cannot
